CVE-2026-95814
Description
A flaw was found in Vaultwarden. This vulnerability allows revoked and not-yet-confirmed organization members to bypass authorization checks. By exploiting missing status filters in specific access-restriction queries, these unauthorized members can retain read, write, delete, and attachment access to sensitive organization ciphers, leading to unauthorized information disclosure and modification.
Statement
In deployments running Vaultwarden packages from Fedora or EPEL, this vulnerability is rated Important rather than Moderate because authenticated users can remotely circumvent access controls to view, alter, or delete shared organizational secrets without administrative privileges. Although successful exploitation requires the attacker to possess an account with pending or revoked organization membership, the flaw undermines the intended segregation of sensitive vault credentials. Vaultwarden is distributed as part of Extra Packages for Enterprise Linux (EPEL) and Fedora community repositories, and is not shipped in core Red Hat Enterprise Linux.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
