CVE-2026-95814: Vaultwarden Auth Bypass Vulnerability

CVE-2026-95814 Overview

Vaultwarden through version 1.37.3 contains an authorization bypass vulnerability in its organization cipher access-restriction logic. Three database query functions omit membership status validation, allowing revoked or not-yet-confirmed organization members to retain read, write, delete, and attachment access to organization ciphers. The flaw resides in get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group within the cipher and group models. Attackers with revoked or pending membership can exploit these missing status filters server-side to access protected cipher data. The vulnerability is classified as [CWE-863] Incorrect Authorization.

Critical Impact
Revoked and unconfirmed organization members retain full access to organization ciphers, including secrets that administrators believed were revoked following offboarding.

Affected Products

Vaultwarden through 1.37.3
Vaultwarden cipher access-control layer (src/db/models/cipher.rs)
Vaultwarden group access-control layer (src/db/models/group.rs)

Discovery Timeline

2026-09-22 - CVE-2026-95814 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95814

Vulnerability Analysis

Vaultwarden is a Rust-based, self-hosted implementation of the Bitwarden server API. It enforces organization access controls through database-side queries that filter ciphers by user, collection, and group membership. Three of these queries fail to check the membership status column, treating revoked and pending users as fully active members.

Because the enforcement occurs at the query layer, the bypass affects every server-side operation that consults these functions. This includes reading cipher contents, modifying entries, deleting items, and downloading file attachments. Client-side status displays do not restrict access when the backend does not enforce it.

The impact is significant for offboarding workflows. Administrators who revoke a member expect immediate loss of access to shared vault items, but the affected member continues to hold effective read and write access until they are fully removed from the organization.

Root Cause

The root cause is missing status filtering in three access-restriction queries: get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group. These functions return membership rows without filtering on the organization membership status column, which distinguishes Confirmed members from Invited, Accepted, and Revoked states. See the VulnCheck Security Advisory for the technical breakdown.

Attack Vector

An attacker requires low-privilege access as a Vaultwarden user whose organization membership has been revoked or never confirmed. Using standard Bitwarden API clients, the attacker issues authenticated cipher requests to the Vaultwarden server. Because the server-side authorization queries do not filter on membership status, the requests succeed and return organization cipher data. No special tooling or unauthenticated network position is required.

The corrective patch is available in GitHub Pull Request #7554, which adds status validation to the three affected queries.

Detection Methods for CVE-2026-95814

Indicators of Compromise

Cipher read, write, delete, or attachment API requests originating from user accounts whose organization membership status is Revoked or non-Confirmed.
Vaultwarden access logs showing successful /api/ciphers/* responses tied to offboarded user identifiers.
Attachment download activity from accounts that have been removed from an organization but not deleted from the instance.

Detection Strategies

Correlate Vaultwarden application logs with the organization membership table to flag any API activity from users whose status column is not Confirmed.
Inspect reverse proxy or ingress logs for authenticated cipher endpoint calls originating from IPs associated with terminated employees or contractors.
Review database audit logs for reads against organization ciphers by user IDs that no longer hold active membership.

Monitoring Recommendations

Enable verbose Vaultwarden logging and forward events to a centralized log platform for retention and correlation.
Alert on API access to organization ciphers within a defined window after a membership revocation event.
Track version metadata across all Vaultwarden deployments to identify instances still running 1.37.3 or earlier.

How to Mitigate CVE-2026-95814

Immediate Actions Required

Upgrade Vaultwarden to a release that includes the fix from GitHub Pull Request #7554.
Fully remove, rather than revoke, any organization members who no longer require access, then rotate shared secrets they could have retrieved.
Audit organization membership tables for accounts in Revoked or Invited state and confirm whether they accessed ciphers during the exposure window.

Patch Information

The upstream fix is tracked in GitHub Pull Request #7554 against the Vaultwarden repository. The patch adds membership status validation to get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group in src/db/models/cipher.rs and src/db/models/group.rs. Administrators should deploy the patched container image and restart the Vaultwarden service.

Workarounds

Delete affected members from the organization instead of using the Revoke action until the patch is applied.
Restrict Vaultwarden network exposure to trusted networks or VPN clients to limit who can reach the vulnerable API endpoints.
Rotate credentials stored in organization ciphers that were accessible to any revoked or pending member during the affected time period.

bash

# Configuration example: pull the patched Vaultwarden image and restart the service
docker pull vaultwarden/server:latest
docker stop vaultwarden && docker rm vaultwarden
docker run -d --name vaultwarden \
  -v /vw-data/:/data/ \
  -p 80:80 \
  vaultwarden/server:latest