Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-43913— Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault

Quick assessment

Affected
dani-garcia vaultwarden
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vaultwarden是Daniel García个人开发者的一个用 Rust 编写的 Bitwarden 服务器 API 的替代实现。 Vaultwarden 1.35.5之前版本存在安全漏洞，该漏洞源于允许未确认的组织所有者清除整个组织保险库，组织邀请流程使用两步过程，POST /api/ciphers/purge端点仅检查成员类型为所有者而不验证成员状态为已确认，已受邀为组织所有者并已接受邀请但尚未被确认的认证用户可调用此端点硬删除组织中的所有密码和附件，导致立即的组织范围数据丢失。

CVSS 8.1 · High EPSS 0.40% · P32

Possible ATT&CK Techniques 1 AI

T1485.001 · Lifecycle-Triggered Deletion

Affected Version Matrix 1

VendorProduct Version RangeStatus
dani-garcia vaultwarden < 1.35.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-43913

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault
Source: CVE Program / CVE List V5
Vulnerability Description
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flow uses a two-step process: accepting an invite transitions membership from Invited to Accepted, and a separate confirmation by an existing owner upgrades it to Confirmed. The POST /api/ciphers/purge endpoint uses plain Headers and only checks that the membership type is Owner without verifying that the membership status is Confirmed. An authenticated user who has been invited as an organization owner and has accepted the invite and has not yet been confirmed can call this endpoint to hard-delete all ciphers and attachments in the organization, causing immediate organization-wide data loss. This vulnerability is fixed in 1.35.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Vaultwarden 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vaultwarden是Daniel García个人开发者的一个用 Rust 编写的 Bitwarden 服务器 API 的替代实现。 Vaultwarden 1.35.5之前版本存在安全漏洞，该漏洞源于允许未确认的组织所有者清除整个组织保险库，组织邀请流程使用两步过程，POST /api/ciphers/purge端点仅检查成员类型为所有者而不验证成员状态为已确认，已受邀为组织所有者并已接受邀请但尚未被确认的认证用户可调用此端点硬删除组织中的所有密码和附件，导致立即的组织范围数据丢失。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
dani-garcia vaultwarden < 1.35.5 -

II. Public POCs for CVE-2026-43913

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-43913

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-43913 (1)

Same Patch Batch · dani-garcia · 2026-05-11 · 4 CVEs total

CVE-2026-43912 8.7 HIGH Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Anoth
CVE-2026-43914 7.3 HIGH Vaultwarden: Brute-force protection bypass vulnerability
CVE-2026-43911 6.8 MEDIUM Vaultwarden: Refresh tokens not invalidated on security stamp rotation

IV. Related Vulnerabilities

Same product: vaultwarden
Same vendor: dani-garcia
Same weakness: CWE-863

V. Comments for CVE-2026-43913

No comments yet

Leave a comment