CVE-2026-95814— Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check
Quick assessment
Affected
dani-garcia vaultwarden
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-95814
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check
Source: CVE Program / CVE List V5
Vulnerability Description
Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can exploit missing status filters in get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group to access protected cipher data server-side.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| dani-garcia | vaultwarden | 0 ~ 1.37.3 | - |
|
II. Public POCs for CVE-2026-95814
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-95814
请登录查看更多情报信息。
Other References for CVE-2026-95814 (5)
-
-
https://github.com/dani-garcia/vaultwarden/blob/1.37.3/src/db/models/group.rs technical-description
-
https://github.com/dani-garcia/vaultwarden/blob/1.37.3/src/db/models/cipher.rs technical-description
IV. Related Vulnerabilities
Same product: vaultwarden
-
CVE-2026-47160
Vaultwarden: Server-side request forgery (SSRF) via Icon End -
CVE-2026-47164
Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local -
CVE-2026-47159
Vaultwarden: Authentication Flow Information Disclosure in S -
CVE-2026-47158
Vaultwarden: CSRF in SSO Authorization Flow -
CVE-2026-43914
Vaultwarden: Brute-force protection bypass vulnerability
Same vendor: dani-garcia
-
CVE-2026-47160
Vaultwarden: Server-side request forgery (SSRF) via Icon End -
CVE-2026-47164
Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local -
CVE-2026-47159
Vaultwarden: Authentication Flow Information Disclosure in S -
CVE-2026-47158
Vaultwarden: CSRF in SSO Authorization Flow -
CVE-2026-43914
Vaultwarden: Brute-force protection bypass vulnerability
Same weakness: CWE-863
-
CVE-2026-79767
Gardener: Authorization Bypass via Group Subject Injection -
CVE-2026-75745
Adobe Experience Manager Forms JEE | Incorrect Authorization -
CVE-2026-75723
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE- -
CVE-2026-75728
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE- -
CVE-2026-75608
Frigate: Viewer-Role User Can Access go2rtc Internal API to
V. Comments for CVE-2026-95814
No comments yet