Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

The primary impact of CVE-2026-27802 is the potential for unauthorized access and modification of sensitive data stored within Vaultwarden. A malicious Manager user could leverage this vulnerability to escalate their privileges and gain control over collections, effectively bypassing access controls. This could lead to data breaches, data corruption, or even complete compromise of the Vaultwarden instance. The blast radius extends to all users whose data is stored within the affected collections, as an attacker could potentially read, modify, or delete their information. While the vulnerability requires a Manager user account, the ease of privilege escalation could allow an attacker to compromise the entire system if they can obtain such an account.

Organizations and individuals relying on Vaultwarden for password management are at risk, particularly those with multiple Manager users or those who have not implemented strong access controls. Shared hosting environments where Vaultwarden instances are deployed alongside other applications are also at increased risk, as a compromise of one application could potentially lead to exploitation of this vulnerability.

• linux / server: Monitor Vaultwarden logs for unusual permission update requests originating from Manager accounts. Use journalctl -u vaultwarden to filter for relevant log entries.

journalctl -u vaultwarden | grep "permission update" | grep "Manager"

• generic web: Monitor access logs for requests targeting the permission update endpoint. Look for requests originating from unusual IP addresses or user agents. Use curl to test endpoint exposure.

curl -v <vaultwarden_url>/api/v1/collections/<collection_id>/permissions

1. 2026-03-04Disclosure

   disclosure

1. Reserviert2026-02-24
2. Veröffentlicht2026-03-04
3. Geändert2026-03-05
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-27802 is to immediately upgrade Vaultwarden to version 1.35.4 or later. If an upgrade is not immediately feasible due to compatibility concerns or system downtime constraints, consider implementing stricter access controls for Manager users. This could involve multi-factor authentication (MFA) for Manager accounts and regular audits of user permissions. While a WAF or proxy cannot directly prevent this vulnerability, it can help detect and block suspicious activity related to permission updates. After upgrading, verify the fix by attempting to perform a bulk permission update as a Manager user; the operation should be denied.