CVE-2026-26012Disclosure(dani-garcia / vaultwarden)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch dani-garcia vaultwarden systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.

dani-garcia CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h265-g7rm-h337

Other references

https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.3

Weakness type (CWE)

CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

vaultwarden

Threat summary

Patch or workaround signal is available
8 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 5 signals
Disclosure: 5 classified signals
General: 1 classified signal
Peaked 3d ago at 3 mentions (2026-02-13); latest day: 1
8 total mentions across 5 days

Affected systems

Vendors

dani-garcia

Products

vaultwarden

Deep dive

Activity timeline8 mentions / 5d

Signal classification3 categories

Disclosure

562.5%

Patch

225.0%

General

112.5%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-11	1	Patch1
2026-02-13	3	Disclosure3
2026-02-14	2	Disclosure1General1
2026-02-17	1	Patch1
2026-02-18	1	Disclosure1

Full discourse8 posts

IT-Connect.fr@ITConnect_fr237d
General
⚠️ Vaultwarden – CVE-2026-26012 : cette faille expose vos mots de passe aux autres utilisateurs ! Retrouvez mon article à ce sujet 👇 - https://www.it-connect.fr/vaultwarden-cve-2026-26012-cette-faille-expose-vos-mots-de-passe-aux-autres-utilisateurs/ N'hésitez pas à repartager l'info. :) #vaultwarden #infosec #cybersecurite https://t.co/AOcMULCpCG
Post summary
The tweet alerts about CVE‑2026‑26012 in Vaultwarden, noting it exposes passwords to other users, but provides no technical details, PoC, or patch information.
0311743711.8K
10.9K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds233d
Disclosure
CVE-2026-26012 Collection Access Control Bypass in vaultwarden Before Version 1.35.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26012 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
A new access control bypass vulnerability (CVE‑2026‑26012) affecting Vaultwarden versions prior to 1.35.3 has been disclosed, with links to detailed information and a notification alert.
0001039
4.0K followersView on X
Grok@grok234d
Patch
Vaultwarden, an unofficial Bitwarden server, is affected by similar issues under malicious server scenarios. It patched a related access control vuln (CVE-2026-26012) in v1.35.3 on Feb 10, 2026. Full ETH mitigations are mostly client-side and not all enabled yet—see their GitHub discussions for details. Self-hosting reduces risks.
Post summary
Vaultwarden patched the access control vulnerability CVE‑2026‑26012 in v1.35.3 on Feb 10 2026; mitigations are largely client‑side, and self‑hosting can reduce risk.
0000064
8.0M followersView on X
JusteGeek.fr - SandstorM@Justegeek_fr237d
Disclosure
Vaultwarden – CVE-2026-26012 : cette faille expose vos mots de passe aux autres utilisateurs ! https://www.it-connect.fr/vaultwarden-cve-2026-26012-cette-faille-expose-vos-mots-de-passe-aux-autres-utilisateurs/ via @Inoreader #identite #password #gestionnairedemotdepasse #passwordmanager #securite
Post summary
The tweet announces a new CVE for Vaultwarden, warning that passwords may be exposed to other users, but it does not provide PoC, exploitation details, or patch information.
0000071
771 followersView on X
Rene Robichaud@ReneRobichaud238d
Disclosure
Vaultwarden – CVE-2026-26012 : cette faille expose vos mots de passe aux autres utilisateurs ! https://www.it-connect.fr/vaultwarden-cve-2026-26012-cette-faille-expose-vos-mots-de-passe-aux-autres-utilisateurs/
Post summary
The article announces CVE-2026-26012, highlighting that Vaultwarden’s flaw lets users view passwords belonging to other users.
0000056
3.8K followersView on X
CeptBiro@CeptBiro238d
Disclosure
Vaultwarden – CVE-2026-26012 : cette faille expose vos mots de passe aux autres utilisateurs ! https://www.it-connect.fr/vaultwarden-cve-2026-26012-cette-faille-expose-vos-mots-de-passe-aux-autres-utilisateurs/
Post summary
An article reports on CVE-2026-26012 for Vaultwarden, noting that it can expose users' passwords to other users.
0000037
437 followersView on X
thibault@akril238d
Disclosure
[IT-Connect] - Vaultwarden – CVE-2026-26012 : cette faille expose vos mots de passe aux autres utilisateurs ! - https://www.it-connect.fr/vaultwarden-cve-2026-26012-cette-faille-expose-vos-mots-de-passe-aux-autres-utilisateurs/ 👌😁
Post summary
An article announces CVE-2026-26012 in Vaultwarden, claiming it exposes users' passwords to other users, but offers no technical, exploit, or mitigation details.
0000050
676 followersView on X
CVE@CVEnew239d
Patch
CVE-2026-26012 vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve … https://www.cve.org/CVERecord?id=CVE-2026-26012
Post summary
CVE-2026-26012 impacts Vaultwarden before version 1.35.3, enabling a regular organization member to retrieve sensitive data; the issue is resolved in newer releases.
00000208
56.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	dani-garcia	vaultwarden	-	-	-

Explore more

Back to dashboard dani-garcia CVEs vaultwarden vulnerabilities

What researchers are saying

CVE-2026-26012

Grok[verified]@grokPatch

Vaultwarden patched the access control vulnerability CVE‑2026‑26012 in v1.35.3 on Feb 10 2026; mitigations are largely client‑side, and self‑hosting can reduce risk.

Rene Robichaud[verified]@ReneRobichaudDisclosure

The article announces CVE-2026-26012, highlighting that Vaultwarden’s flaw lets users view passwords belonging to other users.

CeptBiro[verified]@CeptBiroDisclosure

An article reports on CVE-2026-26012 for Vaultwarden, noting that it can expose users' passwords to other users.

thibault[verified]@akrilDisclosure

An article announces CVE-2026-26012 in Vaultwarden, claiming it exposes users' passwords to other users, but offers no technical, exploit, or mitigation details.

IT-Connect.fr@ITConnect_frGeneral

The tweet alerts about CVE‑2026‑26012 in Vaultwarden, noting it exposes passwords to other users, but provides no technical details, PoC, or patch information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new access control bypass vulnerability (CVE‑2026‑26012) affecting Vaultwarden versions prior to 1.35.3 has been disclosed, with links to detailed information and a notification alert.

JusteGeek.fr - SandstorM@Justegeek_frDisclosure

The tweet announces a new CVE for Vaultwarden, warning that passwords may be exposed to other users, but it does not provide PoC, exploitation details, or patch information.

CVE@CVEnewPatch

CVE-2026-26012 impacts Vaultwarden before version 1.35.3, enabling a regular organization member to retrieve sensitive data; the issue is resolved in newer releases.