CVE-2026-26012: Vaultwarden Auth Bypass Vulnerability

CVE-2026-26012 Overview

CVE-2026-26012 is a Broken Access Control vulnerability in Vaultwarden, an unofficial Bitwarden-compatible server written in Rust (formerly known as bitwarden_rs). Prior to version 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of their collection-level permissions. The vulnerable endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers without enforcing proper collection-level access control.

Critical Impact

Unauthorized access to sensitive password vault data allows low-privileged organization members to view all stored credentials, secrets, and secure notes across the entire organization, bypassing intended collection-based access restrictions.

Affected Products

• Vaultwarden versions prior to 1.35.3
• Self-hosted Bitwarden-compatible deployments using vulnerable Vaultwarden builds
• Docker deployments using Vaultwarden images before the 1.35.3 release

Discovery Timeline

• 2026-02-11 - CVE-2026-26012 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-26012

Vulnerability Analysis

This vulnerability represents a classic Broken Access Control flaw (CWE-863: Incorrect Authorization) in the Vaultwarden password manager server. The core issue lies in the /ciphers/organization-details API endpoint, which fails to enforce collection-level access control when returning cipher data to organization members.

In Vaultwarden's organizational model, ciphers (encrypted password entries, secure notes, etc.) are organized into collections, and users are granted access to specific collections rather than the entire organization's vault. However, the vulnerable endpoint bypasses this security model entirely by calling Cipher::find_by_org to fetch all organization ciphers and returning them with CipherSyncType::Organization without validating whether the requesting user has permission to access each cipher's associated collection.

This allows any authenticated organization member—even those with minimal permissions—to enumerate and retrieve the full contents of an organization's password vault, including credentials they should not have access to.

Root Cause

The root cause is missing authorization checks in the /ciphers/organization-details endpoint handler. The code retrieves all ciphers belonging to an organization using Cipher::find_by_org but fails to filter the results based on the authenticated user's collection memberships. The response is constructed using CipherSyncType::Organization which assumes organization-wide access rather than respecting the collection-based permission model.

Attack Vector

The attack can be executed over the network by any authenticated user who is a member of a Vaultwarden organization. The attacker requires low-level privileges (basic organization membership) and no user interaction is needed. The attack flow involves:

1. The attacker authenticates to the Vaultwarden instance as a regular organization member
2. The attacker sends a request to the /ciphers/organization-details endpoint
3. The server returns all organization ciphers without validating collection permissions
4. The attacker can now access credentials and secrets from collections they should not have access to

The vulnerability is exploited by simply making an authenticated API request to the vulnerable endpoint. An attacker with basic organization membership can access the full organization cipher database, including credentials assigned to restricted collections. For technical implementation details, refer to the GitHub Security Advisory GHSA-h265-g7rm-h337.

Detection Methods for CVE-2026-26012

Indicators of Compromise

• Unusual or excessive API requests to /ciphers/organization-details from low-privileged organization members
• Access log entries showing cipher retrieval requests from users who should not have organization-wide access
• Audit trail inconsistencies where users accessed ciphers outside their assigned collections
• Multiple rapid requests to organization cipher endpoints indicating automated enumeration

Detection Strategies

• Monitor API access logs for requests to /ciphers/organization-details and correlate with user permission levels
• Implement application-layer logging to track cipher access patterns and flag anomalous behavior
• Review Vaultwarden access logs for unauthorized data access patterns from organization members
• Deploy network monitoring to detect bulk data exfiltration from the Vaultwarden API

Monitoring Recommendations

• Enable verbose logging in Vaultwarden to capture all API endpoint access with user context
• Set up alerts for organization members accessing cipher counts that exceed their collection permissions
• Implement periodic access control audits comparing user permissions to actual data access patterns
• Monitor for changes in organization membership that could indicate insider threat preparation

How to Mitigate CVE-2026-26012

Immediate Actions Required

• Upgrade Vaultwarden to version 1.35.3 or later immediately
• Audit organization membership and remove any unnecessary or suspicious accounts
• Review access logs for potential exploitation during the vulnerability window
• Rotate credentials stored in affected organization vaults as a precautionary measure
• Consider temporarily restricting organization access until the patch is applied

Patch Information

The vulnerability is fixed in Vaultwarden version 1.35.3. The patch implements proper collection-level access control checks in the /ciphers/organization-details endpoint, ensuring users can only retrieve ciphers from collections they have been explicitly granted access to. The fix is available from the Vaultwarden 1.35.3 Release.

Workarounds

• Restrict network access to the Vaultwarden instance to trusted IP ranges only
• Implement additional authentication layers (reverse proxy with MFA) to limit API access
• Temporarily disable organization features if upgrading is not immediately possible
• Apply network segmentation to isolate the Vaultwarden server from untrusted network segments

# Example: Upgrade Vaultwarden Docker deployment to patched version
docker pull vaultwarden/server:1.35.3
docker stop vaultwarden
docker rm vaultwarden
docker run -d --name vaultwarden \
  -v /vw-data/:/data/ \
  -p 80:80 \
  vaultwarden/server:1.35.3