CVE-2026-27898

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27898", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-24T15:19:29.717Z", "datePublished": "2026-03-04T21:44:45.461Z", "dateUpdated": "2026-03-05T15:42:31.635Z"}, "containers": {"cna": {"title": "Vaultwarden: Unauthorized Access via Partial Update API on Another User\u2019s Cipher", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w9f8-m526-h7fh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w9f8-m526-h7fh"}], "affected": [{"vendor": "dani-garcia", "product": "vaultwarden", "versions": [{"version": "< 1.35.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-04T21:44:45.461Z"}, "descriptions": [{"lang": "en", "value": "Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, an authenticated regular user can specify another user\u2019s cipher_id and call \"PUT /api/ciphers/{id}/partial\" Even though the standard retrieval API correctly denies access to that cipher, the partial update endpoint returns 200 OK and exposes cipherDetails (including name, notes, data, secureNote, etc.). This issue has been patched in version 1.35.4."}], "source": {"advisory": "GHSA-w9f8-m526-h7fh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T15:29:18.966051Z", "id": "CVE-2026-27898", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:42:31.635Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27898", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-05T15:29:18.966051Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:29:19.983Z"}}], "cna": {"title": "Vaultwarden: Unauthorized Access via Partial Update API on Another User\u2019s Cipher", "source": {"advisory": "GHSA-w9f8-m526-h7fh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "dani-garcia", "product": "vaultwarden", "versions": [{"status": "affected", "version": "< 1.35.4"}]}], "references": [{"url": "https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w9f8-m526-h7fh", "name": "https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w9f8-m526-h7fh", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, an authenticated regular user can specify another user\u2019s cipher_id and call \"PUT /api/ciphers/{id}/partial\" Even though the standard retrieval API correctly denies access to that cipher, the partial update endpoint returns 200 OK and exposes cipherDetails (including name, notes, data, secureNote, etc.). This issue has been patched in version 1.35.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-04T21:44:45.461Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27898", "state": "PUBLISHED", "dateUpdated": "2026-03-05T15:42:31.635Z", "dateReserved": "2026-02-24T15:19:29.717Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-04T21:44:45.461Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "vaultwarden", "vendor": "dani-garcia", "versions": [{"status": "affected", "version": "< 1.35.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:*", "matchCriteriaId": "3EE3AB66-F61B-479C-A6C3-C2EEEB6FD55A", "versionEndExcluding": "1.35.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, an authenticated regular user can specify another user\u2019s cipher_id and call \"PUT /api/ciphers/{id}/partial\" Even though the standard retrieval API correctly denies access to that cipher, the partial update endpoint returns 200 OK and exposes cipherDetails (including name, notes, data, secureNote, etc.). This issue has been patched in version 1.35.4."}, {"lang": "es", "value": "Vaultwarden es un servidor compatible con Bitwarden no oficial escrito en Rust, anteriormente conocido como bitwarden_rs. Antes de la versi\u00f3n 1.35.4, un usuario regular autenticado puede especificar el cipher_id de otro usuario y llamar a 'PUT /api/ciphers/{id}/partial'. Aunque la API de recuperaci\u00f3n est\u00e1ndar deniega correctamente el acceso a ese cifrado, el endpoint de actualizaci\u00f3n parcial devuelve 200 OK y expone cipherDetails (incluyendo nombre, notas, datos, secureNote, etc.). Este problema ha sido parcheado en la versi\u00f3n 1.35.4."}], "id": "CVE-2026-27898", "lastModified": "2026-06-17T10:27:50.620", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27898", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T15:29:18.966051Z", "version": "2.0.3"}}]}, "published": "2026-03-04T22:16:18.373", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w9f8-m526-h7fh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vaultwarden: Vaultwarden: Information disclosure via API partial update", "id": "2444681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444681"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-639", "details": ["No description is available for this CVE."], "name": "CVE-2026-27898", "public_date": "2026-03-04T21:44:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-27898\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27898\nhttps://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w9f8-m526-h7fh"], "statement": "This MODERATE information disclosure vulnerability in Vaultwarden allows an authenticated user to retrieve another user's cipher details via the partial update API endpoint (CWE-639 IDOR). Exploitation requires network access and valid authentication (PR:L). Impact is limited to high confidentiality loss (exposure of names, notes, secure notes); no integrity or availability impact. Affects versions prior to 1.35.4. Red Hat does not ship Vaultwarden.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.35.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vaultwarden", "source": "cna", "vendor": "dani-garcia"}, "product": "vaultwarden", "vendor": "dani-garcia"}], "analysis": {"en": {"generated_at": "2026-04-17T13:01:46.986006+00:00", "value": {"mitigation_remediation": ["Upgrade Vaultwarden to version 1.35.4 or later to eliminate the partial update data leak", "Audit and monitor API activity for unexpected partial update calls to detect potential abuse", "Implement network segmentation or firewall rules to limit API exposure to trusted hosts or VPNs"], "summary": {"action": "Apply Patch", "impact": "Unauthorized disclosure of other users' cipher data"}, "threat_synthesis": {"affected_systems": "Vaultwarden, an unofficial Bitwarden-compatible server written in Rust, is affected when running any version older than 1.35.4. The vulnerability applies to all deployments of the dani-garcia:vaultwarden product, regardless of the environment or configuration, as long as the user is authenticated and has a valid session.", "description_and_impact": "The vulnerability allows an authenticated regular user to supply another user's cipher identifier to the partial update endpoint. Although the standard retrieval API correctly blocks such access, the update endpoint returns a 200 OK response and leaks the full cipher details\u2014including name, notes, data, and secure note information\u2014effectively enabling the attacker to read confidential data belonging to a different user. This issue stems from an authorization bypass (CWE-639) and represents a moderate severity confidentiality violation as the attacker gains unauthorized read access to encrypted data without modifying or deleting it.", "risk_and_exploitability": "Based on the description, the likely attack vector is an authenticated user sending a request to the partial update API with a chosen cipher identifier. The CVSS score of 5.4 reflects moderate risk, while the EPSS score is less than 1\u202f%, indicating a very low likelihood of widespread exploitation at present. The vulnerability is not classified in the CISA KEV catalog. The attack likely requires a legitimate authenticated user who can interact with the Vaultwarden API. Since the partial update endpoint accepts a cipher identifier, a malicious user can enumerate or guess valid identifiers or target known IDs. The internal exploit does not require elevated privileges or external network exposure, making the risk mainly confined to environments where user accounts are actively used."}}}}, "created": "2026-03-05T09:05:43.272503+00:00", "updated": "2026-04-17T13:15:19.648847+00:00", "vendors": ["dani-garcia", "dani-garcia$PRODUCT$vaultwarden"]}