Vulnerability · Published Mar 4, 2026 · Assigned by GitHub_M

CVE-2026-27898Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in vaultwarden from dani-garcia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 91.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, an authenticated regular user can specify another user’s cipher_id and call "PUT /api/ciphers/{id}/partial" Even though the standard retrieval API correctly denies access to that cipher, the partial update endpoint returns 200 OK and exposes cipherDetails (including name, notes, data, secureNote, etc.). This issue has been patched in version 1.35.4.

Affected products (as reported)

Vendor	Product	Versions
dani-garcia	vaultwarden	< 1.35.4

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w9f8-m526-h7fh x_refsource_CONFIRM