Vulnerability · Published Sep 22, 2026 · Assigned by VulnCheck

CVE-2026-95814Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check

High 8.1

In plain English

A high-severity incorrect authorization in vaultwarden from dani-garcia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 62.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can exploit missing status filters in get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group to access protected cipher data server-side.

Affected products (as reported)

Vendor	Product	Versions
dani-garcia	vaultwarden	0 – through 1.37.3

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Pull Request #7554 (open, unmerged) patch, issue-tracking
Cipher::get_access_restrictions at 1.37.3 technical-description
Group::is_in_full_access_group at 1.37.3 technical-description
https://github.com/dani-garcia/vaultwarden product
VulnCheck Advisory: Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check third-party-advisory