CVE-2026-95814 Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check
Attackers with revoked or pending membership can access, modify, or delete organization cipher data due to missing status checks in Vaultwarden.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-95814?
CVE-2026-95814 is a high-severity missing authorization vulnerability in dani-garcia vaultwarden, published on 22 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can exploit missing status filters in get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group to access protected cipher data server-side.
Weakness: CWE-863
Which versions are affected by CVE-2026-95814?
How do I fix CVE-2026-95814?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-95814 being exploited?
There is no known exploitation of CVE-2026-95814 in the wild and no public exploit code.
Sources
Also known as GHSA-hm7r-36jx-j25q, MINI-m2r3-wrp8-w2r5.