CVE-2026-27802: Privilege Escalation in Vaultwarden

The primary impact of CVE-2026-27802 is the potential for unauthorized access and modification of sensitive data stored within Vaultwarden. A malicious Manager user could leverage this vulnerability to escalate their privileges and gain control over collections, effectively bypassing access controls. This could lead to data breaches, data corruption, or even complete compromise of the Vaultwarden instance. The blast radius extends to all users whose data is stored within the affected collections, as an attacker could potentially read, modify, or delete their information. While the vulnerability requires a Manager user account, the ease of privilege escalation could allow an attacker to compromise the entire system if they can obtain such an account.

1. Reserved2026-02-24
2. Published2026-03-04
3. Modified2026-03-05
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-27802 is to immediately upgrade Vaultwarden to version 1.35.4 or later. If an upgrade is not immediately feasible due to compatibility concerns or system downtime constraints, consider implementing stricter access controls for Manager users. This could involve multi-factor authentication (MFA) for Manager accounts and regular audits of user permissions. While a WAF or proxy cannot directly prevent this vulnerability, it can help detect and block suspicious activity related to permission updates. After upgrading, verify the fix by attempting to perform a bulk permission update as a Manager user; the operation should be denied.