A privilege escalation vulnerability in Vaultwarden versions prior to 1.35.4 allows authenticated Managers to gain unauthorized access to restricted collections.

The vulnerability stems from improper privilege management and incorrect authorization, specifically within the bulk permission update function. An authenticated user with Manager privileges can exploit this flaw to modify permissions for collections they are not authorized to manage.

This vulnerability poses a significant risk to the confidentiality and integrity of sensitive credential data stored within the Vaultwarden instance. With a CVSS score of 8.3, the flaw is considered high severity because it enables lateral movement and unauthorized access to data vaults, potentially leading to widespread credential exposure across the organization.

Immediate Action: Update the Vaultwarden instance to version 1.35.4 or later to resolve the underlying authorization flaw.

Proactive Monitoring: Review administrative access logs for unusual patterns of bulk permission changes or unauthorized attempts to access collections by users with Manager roles.

Compensating Controls: Restrict the Manager role to only the most trusted users until the patch is applied, and ensure that auditing is enabled to track all changes to vault and collection permissions.

Public Exploit Available: No

Given the high CVSS score and the nature of Vaultwarden as a centralized credential manager, the risk of unauthorized data access is severe. Organizations should prioritize patching to version 1.35.4 immediately to prevent privilege escalation and ensure that only authorized personnel maintain control over sensitive collection permissions.