{"id":"CVE-2026-26012","aliases":["EUVD-2026-6209","GHSA-h265-g7rm-h337"],"status":"published","title":"vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions","description":"vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00467,"percentile":0.40906,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-863"],"published":"2026-02-11T21:14:58Z","modified":"2026-10-28T02:30:36Z","exploits":[{"source":"pocgithub","id":"Dulieno/CVE-2026-26012","title":"Dulieno/CVE-2026-26012","date":"2026-02-16","url":"https://github.com/Dulieno/CVE-2026-26012"}],"products":[{"vendor":"dani-garcia","product":"vaultwarden"}],"references":[{"url":"https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h265-g7rm-h337","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory"]},{"url":"https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.3","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26012.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26012","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-26012","title":"vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions","description":"vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.","status":"published","published":"2026-02-11T21:14:58.102Z","modified":"2026-02-12T21:15:25.318Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:38:20.971157Z"}],"euvd":[{"id":"EUVD-2026-6209","description":"vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.","status":"published","published":"2026-02-11T21:14:58Z","modified":"2026-02-12T21:15:25Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:39.919829Z"}],"nvd":[{"id":"CVE-2026-26012","description":"vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.","status":"published","published":"2026-02-11T22:15:51.703Z","modified":"2026-06-17T10:25:35.817Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:05.908608Z"}],"osv":[{"id":"CVE-2026-26012","title":"vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions","description":"vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.","status":"published","published":"2026-02-11T21:14:58.102Z","modified":"2026-10-28T02:30:36.621434353Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:59.80315Z"}]}}