Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

vaultwarden

7 known vulnerabilities (2 critical, 2 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 critical, 2 high, 3 medium
Weekly downloads
4
Dependents
0
Registry
crates.io

Advisories 7

  • CVE-2026-27898Medium 5.4

    Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher

    Affected: fixed in 1.35.4.

  • Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

    Affected: fixed in 1.35.4.

  • Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

    Affected: fixed in 1.35.4.

  • CVE-2026-27801Medium 6.0

    Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

    Affected: fixed in 1.35.0.

  • CVE-2024-55226Medium 5.4

    Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component…

    Affected: fixed in 1.32.5.

  • CVE-2024-55225Critical 9.8

    An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including…

    Affected: fixed in 1.32.5.

  • CVE-2024-55224Critical 9.6

    An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload…

    Affected: fixed in 1.32.5.