Vaultwarden: 管理员通过批量更新未授权集合的权限实现特权提升

该漏洞的潜在影响非常严重。攻击者可以利用此漏洞获得对 Vaultwarden 服务器的未经授权的访问权限，并可能访问敏感数据，例如密码和加密密钥。攻击者还可以利用此漏洞来控制整个服务器，并可能对其进行恶意利用。由于 Vaultwarden 通常用于存储和管理密码，因此此漏洞可能导致严重的隐私泄露和数据安全事件。攻击者可能利用此漏洞进行横向移动，访问其他系统和数据。

Organizations and individuals relying on Vaultwarden for password management are at risk, particularly those with multiple Manager users or those who have not implemented strong access controls. Shared hosting environments where Vaultwarden instances are deployed alongside other applications are also at increased risk, as a compromise of one application could potentially lead to exploitation of this vulnerability.

• linux / server: Monitor Vaultwarden logs for unusual permission update requests originating from Manager accounts. Use journalctl -u vaultwarden to filter for relevant log entries.

journalctl -u vaultwarden | grep "permission update" | grep "Manager"

• generic web: Monitor access logs for requests targeting the permission update endpoint. Look for requests originating from unusual IP addresses or user agents. Use curl to test endpoint exposure.

curl -v <vaultwarden_url>/api/v1/collections/<collection_id>/permissions

1. 2026-03-04Disclosure

   disclosure

1. 已保留2026-02-24
2. 发布日期2026-03-04
3. 修改日期2026-03-05
4. EPSS 更新日期2026-03-23

最有效的缓解措施是立即将 Vaultwarden 升级到 1.35.4 或更高版本。如果无法立即升级，可以考虑实施一些临时缓解措施。例如，可以限制 Manager 用户的权限，以防止其批量更新未经授权的集合的权限。还可以配置防火墙规则，以阻止对 Vaultwarden 服务器的未经授权的访问。在升级后，请验证 Vaultwarden 是否已成功更新，并确认权限控制是否正常工作。