CVE-2026-43912

{
  "id": "CVE-2026-43912",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T23:20:21.980",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a groups_users.users_organizations_uuid entry belongs to the same organization as groups.groups_uuid, or a collections_groups.collections_uuid entry belongs to the same organization as collections_groups.groups_uuid. Multiple organization group-management endpoints accept arbitrary MembershipId and CollectionId values and persist them directly without verifying org consistency. This lets an attacker who is Admin in Organization A, and only a low-privileged member in Organization B bind their Org B membership UUID into an Org A group, then use that foreign group relationship to gain unauthorized access to Org B vault data. With an accessAll=true Org A group, the attacker can make /api/sync and /api/ciphers enumerate Org B ciphers. Once those unauthorized sync results reveal Org B collection IDs, the attacker can also bind those foreign collection IDs to the Org A group and turn the same flaw into write access over Org B items. This vulnerability is fixed in 1.35.5."
    },
    {
      "lang": "es",
      "value": "Vaultwarden es un servidor compatible con Bitwarden escrito en Rust. Antes de la versión 1.35.5, Vaultwarden no exige que una entrada groups_users.users_organizations_uuid pertenezca a la misma organización que groups.groups_uuid, o que una entrada collections_groups.collections_uuid pertenezca a la misma organización que collections_groups.groups_uuid. Múltiples puntos finales de gestión de grupos de organizaciones aceptan valores arbitrarios de MembershipId y CollectionId y los persisten directamente sin verificar la consistencia de la organización. Esto permite a un atacante que es Administrador en la Organización A, y solo un miembro con privilegios bajos en la Organización B, vincular su UUID de membresía de la Org B a un grupo de la Org A, y luego usar esa relación de grupo externa para obtener acceso no autorizado a los datos de la bóveda de la Org B. Con un grupo de la Org A con accessAll=true, el atacante puede hacer que /api/sync y /api/ciphers enumeren los cifrados de la Org B. Una vez que esos resultados de sincronización no autorizados revelan los ID de colección de la Org B, el atacante también puede vincular esos ID de colección externos al grupo de la Org A y convertir el mismo fallo en acceso de escritura sobre los elementos de la Org B. Esta vulnerabilidad está corregida en la versión 1.35.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "dani-garcia",
          "product": "vaultwarden",
          "versions": [
            {
              "version": "< 1.35.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T13:19:47.074814Z",
          "id": "CVE-2026-43912",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.35.5",
              "matchCriteriaId": "84C9FEC4-49EA-4F83-9E8F-9DA52A9A987E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-569v-845w-g82p",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-569v-845w-g82p",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}