CVE-2026-95814

Executive Summary

CVE-2026-95814 is a broken access control vulnerability (CWE-863) in Vaultwarden, a popular open-source Bitwarden-compatible password manager server, affecting all versions through 1.37.3. The flaw stems from missing organization membership status validation in three cipher access-restriction queries, allowing users whose organization membership has been revoked or is not yet confirmed to retain full read, write, delete, and attachment access to organization ciphers. With a CVSS score of 8.1, this vulnerability poses a high severity risk, enabling unauthorized access to sensitive credential data stored in shared organizational vaults.

Technical Analysis

Vaultwarden is a lightweight, Rust-based implementation of the Bitwarden server API, widely deployed by small to medium-sized organizations as a self-hosted password management solution. The vulnerability resides in three specific access-control query functions that fail to validate organization membership status before granting cipher access:

1. get_user_collections_access_flags — A query responsible for determining access permissions to collections at the individual user level.
2. get_group_collections_access_flags — A query determining collection access permissions assigned through group membership.
3. is_in_full_access_group — A function determining whether a user belongs to a group with full access privileges to organizational ciphers.

The core defect is that these functions check for membership existence but omit validation of membership status. In Vaultwarden's data model, organization memberships carry status values that include confirmed/active versus revoked or pending (not-yet-confirmed) states. When a user's membership is revoked — for example, due to offboarding, a policy violation, or an administrative dispute — the membership record may persist in the database with a revoked status flag. Because the three affected queries do not filter on this status, the revoked membership continues to match access-control criteria.

The same logic applies to pending memberships: a user who has been invited to an organization but has not yet completed the invitation confirmation process retains access to organization ciphers even though their membership should not yet be active.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates the attacker needs only low privileges (a valid but revoked or pending account), requires no user interaction, and can achieve high confidentiality and integrity impact without affecting availability. The attack is network-accessible and requires no specialized conditions.

This vulnerability is particularly dangerous because it violates a fundamental security assumption in multi-tenant password managers: that revocation of access is immediate and effective. Organizations that offboard employees or revoke access to shared credential stores expect that action to be authoritative. This flaw undermines that expectation at the server API level, silently.

Notably, exploitation occurs server-side — the client application (web vault, mobile, or desktop) is not required to participate in or be aware of the flaw. The server API itself returns cipher data to unauthorized users.

Exploitation Scenarios

Based on the vulnerability class and the limited technical details available, the attack chain proceeds as follows:

1. Reconnaissance / Target Identification: The attacker maintains or regains control of credentials associated with an organization membership that has been revoked or that remains in a not-yet-confirmed (pending) state. This could occur naturally through offboarding processes where a departing employee retains valid authentication credentials, or through a scenario where an invited user never completed confirmation but retained API token access.

2. Authentication: The attacker authenticates to the Vaultwarden server using their existing (but now unauthorized) credentials. Since the vulnerability is in access-control queries rather than authentication, standard authentication succeeds normally.

3. Triggering the Flaw: The attacker issues API requests to retrieve organization ciphers — for example, requesting cipher collections or enumerating ciphers within collections. The server-side queries (get_user_collections_access_flags, get_group_collections_access_flags, is_in_full_access_group) evaluate the attacker's membership records. Because these queries omit status validation, they return positive access flags for the revoked or pending membership.

4. Payload/Execution: No special payload is required. The attacker uses standard Bitwarden API client operations — syncing the vault, listing ciphers, or retrieving individual cipher records — through any API client (web vault, CLI, or custom scripted requests). The server responds with cipher data that should be inaccessible.

5. Post-Exploitation Impact: The attacker gains full read, write, delete, and attachment access to organization ciphers. This includes the ability to:

   • Read: Exfiltrate all credentials, notes, and secrets stored in organizational collections the revoked membership was previously associated with.
   • Write: Modify existing ciphers, potentially injecting malicious credentials or altering URLs to facilitate further attacks (e.g., changing a stored login URL to an attacker-controlled phishing domain).
   • Delete: Destroy organizational vault data, causing operational disruption.
   • Access Attachments: Retrieve file attachments stored with ciphers, which may contain sensitive documents, certificates, or keys.

No public PoC is available; the attack chain is inferred from the vulnerability class. Because no Nuclei template or exploit code exists publicly, exploitation would require custom scripting against the Vaultwarden API rather than off-the-shelf tooling.

Impact Assessment

The business impact is severe for organizations relying on Vaultwarden for centralized credential management:

• Confidentiality (High): Attackers with revoked or pending memberships can exfiltrate all credentials stored in collections they were previously associated with — including service accounts, database passwords, API keys, and infrastructure secrets. This can lead to cascading compromises across the organization's entire technology stack.
• Integrity (High): The ability to write and modify ciphers means attackers can alter stored credentials, potentially redirecting legitimate users to attacker-controlled systems or locking out legitimate access.
• Availability (None): The CVSS vector indicates no direct availability impact, though delete access could arguably affect availability — the vector assessed it as none, suggesting the primary concern is data exposure and manipulation.
• Blast Radius: Any organization deployment of Vaultwarden through version 1.37.3 with multi-user organization features enabled is affected. Because Vaultwarden is commonly self-hosted by smaller organizations without dedicated security teams, detection may be delayed. The vulnerability affects the server API directly, meaning all clients (web, desktop, mobile, CLI) are conduits for exploitation.

The most critical operational risk is that offboarded employees or unconfirmed invitees can silently maintain access to shared vaults — a direct violation of the principle of least privilege and a significant compliance concern (SOC 2, ISO 27001, HIPAA, PCI-DSS all require timely access revocation).

Detection Guidance

Sigma Rule

title: Vaultwarden Cipher Access by Revoked or Pending Organization Member
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects API access to organization ciphers by users whose membership has been revoked or remains unconfirmed, exploiting CVE-2026-95814.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95814
author: Threat Intelligence Team
date: 2026/01/01
tags:
  - attack.valid_accounts
  - attack.t1078
logsource:
  product: vaultwarden
  service: api
detection:
  selection_cipher_access:
    http.method:
      - GET
      - POST
      - PUT
      - DELETE
    http.url|contains:
      - '/api/ciphers'
      - '/api/sync'
      - '/api/organizations'
  selection_membership_anomaly:
    membership_status:
      - 'revoked'
      - 'pending'
      - 'accepted_not_confirmed'
  condition: selection_cipher_access and selection_membership_anomaly
falsepositives:
  - Administrative operations by legitimate owners performing cleanup
level: high

YARA Rule

rule CVE_2026_95814_Vaultwarden_Access_Control_Bypass
{
    meta:
        description = "Detects Vaultwarden source code lacking organization membership status validation in cipher access queries"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95814"
        date = "2026-01-01"
        severity = "high"

    strings:
        $fn1 = "get_user_collections_access_flags"
        $fn2 = "get_group_collections_access_flags"
        $fn3 = "is_in_full_access_group"
        $status_check = "membership_status"
        $confirmed = "Confirmed"
        $revoked = "Revoked"

    condition:
        (
            any of ($fn1, $fn2, $fn3)
        ) and not (
            $status_check or $confirmed
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-95814 Vaultwarden Revoked Member Cipher Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/ciphers"; http.uri; content:"/api/sync"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-95814; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95814; sid:202695814; rev:1;)

Elastic Detection

sequence by user.id with maxspan=5m
  [authentication where event.outcome == "success" and user.name : *]
  [http where http.request.method in ("GET", "POST", "PUT", "DELETE") and
   url.path : ("/api/ciphers*", "/api/sync*", "/api/organizations*") and
   vaultwarden.membership.status in ("revoked", "pending", "not_confirmed")]

Splunk SPL Query

index=vaultwarden sourcetype=vaultwarden:api
| where match(url, "(?i)/api/(ciphers|sync|organizations)")
| join type=left user_id [ search index=vaultwarden sourcetype=vaultwarden:membership
    | where membership_status IN ("revoked", "pending", "not_confirmed")
    | fields user_id, membership_status, organization_id ]
| where isnotnull(membership_status)
| stats count values(membership_status) as status values(url) as accessed_endpoints by user_id, organization_id, src_ip
| where count > 3
| table _time, user_id, organization_id, src_ip, status, accessed_endpoints, count

Wazuh OSSEC Rule

<group name="vaultwarden,cve-2026-95814,">
  <rule id="2026958" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">vaultwarden_api_access</field>
    <field name="url">/api/(ciphers|sync|organizations)</field>
    <field name="membership_status">revoked|pending|not_confirmed</field>
    <description>CVE-2026-95814: Vaultwarden cipher access by revoked or pending organization member</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>access_control,pci_dss_10.2.5,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate Mitigations

• Revoke credentials, not just memberships: When offboarding users or revoking organization memberships, also disable or delete the underlying user account and rotate any API keys or session tokens. Do not rely on membership revocation alone as an access control boundary.
• Audit pending invitations: Review all organizations for memberships in pending/not-yet-confirmed states and delete stale or unconfirmed invitations immediately.
• Audit revoked memberships: Enumerate all membership records marked as revoked and ensure the associated user accounts cannot authenticate.
• Rotate secrets: If a revoked or pending member had prior access to organizational ciphers, treat all credentials in those collections as potentially compromised and rotate them.
• Monitor API logs: Apply the detection rules above to identify anomalous cipher access by revoked or pending members.
• Network controls: Restrict access to the Vaultwarden API to trusted networks or via VPN/zero-trust proxy to reduce the attack surface for external actors.

2) Patch/Upgrade Steps

• No official patch is available at the time of analysis. Monitor the Vaultwarden project's releases and security advisories for a version newer than 1.37.3 that includes organization membership status validation in the affected queries.
• Once a patched release is published, upgrade immediately and verify that get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group now filter on membership status.
• If self-hosted from source, review upstream commits addressing CWE-863 in organization membership handling and apply or backport relevant fixes.

3) Long-Term Hardening

• Defense in depth for access control: Do not rely on a single query function to enforce authorization. Implement server-side middleware or a unified authorization layer that consistently validates both membership existence and status for all organization-scoped operations.
• Automated regression testing: Add unit and integration tests that assert revoked and pending members cannot access organization ciphers, to prevent reintroduction of the flaw.
• Regular access reviews: Conduct periodic audits of organization memberships and cipher access to detect privilege drift.
• Principle of least privilege: Assign collection access through groups with explicit, audited membership management rather than broad organization-wide access.
• Log and alert on status-transition events: Instrument membership state changes and alert on cipher access shortly after a revocation event.

References

• NVD — CVE-2026-95814: https://nvd.nist.gov/vuln/detail/CVE-2026-95814
• CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
• Vaultwarden Project Repository and Releases: https://github.com/dani-garcia/vaultwarden
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• FIRST EPSS (not yet scored at time of analysis): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence have been observed for CVE-2026-95814 at the time of this report. CISA KEV catalog does not list this CVE. No public PoC, Nuclei template, or exploit code is available. Exploitation to date is theoretical and inferred from the access-control flaw class.