CVE-2026-27898

The record

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, an authenticated regular user can specify another user’s cipher_id and call "PUT /api/ciphers/{id}/partial" Even though the standard retrieval API correctly denies access to that cipher, the partial update endpoint returns 200 OK and exposes cipherDetails (including name, notes, data, secureNote, etc.). This issue has been patched in version 1.35.4.

Affected packages

Related vulnerabilities

• GHSA-w9f8-m526-h7fh Vaultwarden has Unauthorized Access via Partial Update API on Another User’s Cipher Same vulnerability
• CVE-2026-27802 Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known… Also affects vaultwarden
• CVE-2026-27803 Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known… Also affects vaultwarden
• CVE-2026-27801 Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known… Also affects vaultwarden
• GHSA-h4hq-rgvh-wh27 Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for… Also affects vaultwarden
• GHSA-r32r-j5jq-3w4m Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized… Also affects vaultwarden
• GHSA-v6pg-v89r-w8wr Vaultwarden has 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement Also affects vaultwarden
• CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before… CWE-639