CVE-2026-33420: Dani-Garcia Vaultwarden

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the get_org_collections_details endpoint (GET /api/organizations/{org_id}/collections/details) is missing the has_full_access() authorization check that exists on the sibling get_org_collections endpoint. This allows any Manager-role user with accessAll=False and no collection assignments to retrieve the names, UUIDs, user-to-collection mappings, and group-to-collection mappings for all collections in the organization. This issue has been fixed in version 1.35.5.

Affected products

• Dani-Garcia Vaultwarden: before 1.35.5 (fixed in 1.35.5)

Published 2026-05-05. Last modified 2026-07-24.