Medium severity · published Mar 4, 2026
CVE-2026-27898
Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, an authenticated regular user can specify another user’s cipher_id and call "PUT /api/ciphers/{id}/partial" Even though the standard retrieval API correctly denies access to that cipher, the partial update endpoint returns 200 OK and exposes cipherDetails (including name, notes, data, secureNote, etc.). This issue has been patched in version 1.35.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
vaultwarden · dani-garcia
< 1.35.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27898
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27898
Vendor Advisory
https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w9f8-m526-h7fh
More from vaultwarden
9.8
CVE-2026-43914
Vaultwarden: Brute-force protection bypass vulnerability
9.8
CVE-2024-55225
An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request
9.6
CVE-2024-55224
An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail…
8.8
CVE-2024-39924
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3
8.7
CVE-2026-43912
Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization