CVE-2026-26012: Dani-Garcia Vaultwarden

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.

Affected products

• Dani-Garcia Vaultwarden: before 1.35.3 (fixed in 1.35.3)

Published 2026-02-11. Last modified 2026-06-17.