dani-garcia/vaultwarden Security Advisories | GitStock

medium2026-03-04

Vaultwarden has Unauthorized Access via Partial Update API on Another User’s Cipher

GHSA-w9f8-m526-h7fh · CVE-2026-27898

high2026-03-04

Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role

GHSA-h4hq-rgvh-wh27 · CVE-2026-27803

high2026-03-04

Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

GHSA-r32r-j5jq-3w4m · CVE-2026-27802

medium2026-03-04

Vaultwarden has 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

GHSA-v6pg-v89r-w8wr · CVE-2026-27801

high2025-01-09

Vaultwarden vulnerable to user impersonation

GHSA-x7m9-mv49-fv73 · CVE-2024-55225

low2025-01-09

Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability

GHSA-vprm-27pv-jp3w · CVE-2024-55226

low2025-01-09

Vaultwarden HTML injection vulnerability

GHSA-g5x8-v2ch-gj2g · CVE-2024-55224