Medium severity6.5NVD Advisory· Published Feb 11, 2026· Updated Jun 17, 2026
CVE-2026-26012
CVE-2026-26012
Description
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3< 1.35.3+ 2 more
- (no CPE)range: < 1.35.3
- cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:*range: <1.35.3
- (no CPE)range: <1.35.3
Patches
Vulnerability mechanics
References
2- github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h265-g7rm-h337nvdVendor Advisory
- github.com/dani-garcia/vaultwarden/releases/tag/1.35.3nvdProductRelease Notes
News mentions
0No linked articles in our index yet.