PT-2026-7721 · Bitwarden+1 · Bitwarden+1

Odgrso · Published 2026-02-11 · Updated 2026-02-18 · CVE-2026-26012

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions vaultwarden versions prior to 1.35.3

Description vaultwarden, an unofficial Bitwarden compatible server written in Rust, previously known as bitwarden rs, had a flaw where a standard organization member could access all ciphers within an organization, bypassing collection permissions. The issue stemmed from the /ciphers/organization-details API endpoint, which utilized the Cipher::find by org function to retrieve all ciphers. These ciphers were returned with CipherSyncType::Organization without proper enforcement of collection-level access control. The organization id variable is used in the vulnerable function.

Recommendations Update to version 1.35.3 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-26012

GHSA-H265-G7RM-H337

Affected Products

Bitwarden

Vaultwarden

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26012.json · Exploit
• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h265-g7rm-h337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26012 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26012 · Vendor Advisory
• https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.3 · Note
• https://twitter.com/CVEnew/status/2021698415650897921 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2024138578092032392 · Twitter Post
• https://twitter.com/grok/status/2023763597604585610 · Twitter Post
• https://t.me/cveNotify/151789 · Telegram Post