CVE-2026-27802: falha de alta gravidade em dani-garcia vaultwarden
Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.3epss 0.3%
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, there is a privilege escalation vulnerability via bulk permission update to unauthorized collections by Manager. This issue has been patched in version 1.35.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Produtos afetados
dani-garcia · vaultwardenCVEs relacionadas — dani-garcia vaultwarden
No mesmo produto, das mais perigosas para as menos.
CVE-2025-24364HIGHvaultwarden allows RCE in the admin panelEPSS 1.0%CVE-2025-24365HIGHvaultwarden allows escalation of privilege via variable confusion in OrgHeaders traitEPSS 0.7%CVE-2026-47159MEDIUMVaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token ExposureEPSS 0.5%CVE-2026-26012MEDIUMvaultwarden has Full Cipher Enumeration Ignoring Organization Collection PermissionsEPSS 0.5%CVE-2026-47164HIGHVaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP IdentityEPSS 0.4%CVE-2026-95814HIGHVaultwarden through 1.37.3 Authorization Bypass via Missing Status CheckEPSS 0.4%