CVE-2026-33420: Vaultwarden missing authorization check allows Manager-role users to enumerate all collections

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-05 · updated 2026-07-24
Weakness: CWE-862

Description

Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the get_org_collections_details endpoint (GET /api/organizations/{org_id}/collections/details) is missing the has_full_access() authorization check that exists on the sibling get_org_collections endpoint. This allows any Manager-role user with accessAll=False and no collection assignments to retrieve the names, UUIDs, user-to-collection mappings, and group-to-collection mappings for all collections in the organization. This issue has been fixed in version 1.35.5.

Affected products

dani-garcia vaultwarden: before 1.35.5 — fixed in 1.35.5

How to fix

Upgrade to a fixed version: dani-garcia vaultwarden 1.35.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33420 or the next vulnerability affects your stack