High severity8.3NVD Advisory· Published Mar 4, 2026· Updated Jun 17, 2026
CVE-2026-27803
CVE-2026-27803
Description
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vaultwardencrates.io | < 1.35.4 | 1.35.4 |
Affected products
3cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:*range: <1.35.4
- (no CPE)range: < 1.35.4
Patches
Vulnerability mechanics
References
2- github.com/advisories/GHSA-h4hq-rgvh-wh27ghsaADVISORY
- github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h4hq-rgvh-wh27nvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.