Vaultwarden versions 1.37.3 and earlier are vulnerable to an authorization bypass that allows unauthorized users to access, modify, or delete sensitive organization credentials.

This is an incorrect authorization vulnerability (CWE-863) occurring within the cipher access-restriction logic. The application fails to validate the membership status of users during specific database queries, allowing authenticated but revoked or unconfirmed members to interact with protected organization ciphers.

Successful exploitation allows unauthorized individuals to compromise sensitive credentials stored within an organization's vault. Given the CVSS score of 8.1, this represents a high-severity risk that could lead to full exposure of proprietary data, unauthorized service access, and a significant breach of organizational security policies.

Immediate Action: Update Vaultwarden to the latest version immediately to ensure membership status validation is correctly applied to all cipher access queries.

Proactive Monitoring: Review organization access logs for unusual activity, specifically focusing on data access patterns associated with revoked or pending user accounts.

Compensating Controls: While no direct WAF rule can replace the required code fix, implementing strict network-level access controls and monitoring API request volumes may help identify potential exploitation attempts.

Public Exploit Available: Unknown

This vulnerability presents a severe risk to the confidentiality and integrity of stored credentials. Administrators must prioritize updating their Vaultwarden instances to a patched version, as the current implementation fails to enforce basic access control policies for revoked users. Failure to patch leaves the organization's secrets accessible to untrusted entities.