CVE-2026-27898: 
Rust vulnerability analysis and mitigation

CVE-2026-27898 is a broken access control vulnerability in Vaultwarden (an unofficial Bitwarden-compatible server written in Rust) that allows an authenticated regular user to access and partially modify another user's encrypted cipher data via the PUT /api/ciphers/{id}/partial endpoint. It affects all versions up to and including 1.35.3, with version 1.35.4 containing the fix. The vulnerability was disclosed on March 4, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the put_cipher_partial handler in src/api/core/ciphers.rs retrieves a cipher by its UUID from user-supplied input but omits the ownership and access control checks that are present in the standard update API (is_write_accessible_to_user). As a result, any authenticated user who knows a victim's cipher_id can call PUT /api/ciphers/{id}/partial and receive a 200 OK response containing full cipherDetails (name, notes, data, secureNote, etc.). Additionally, the response includes attachments[].url — either a tokenized filesystem path or a short-lived pre-signed object storage URL — enabling direct download of attachment data the attacker is not authorized to access (GitHub Advisory).

Successful exploitation allows an authenticated attacker to read another user's encrypted vault entries (names, notes, secure notes, custom fields, and attachment URLs), constituting an unauthorized confidentiality breach. The attacker can also create unauthorized associations within their own user context (e.g., adding the victim's cipher to their favorites or folders), representing an integrity impact. In both filesystem and object storage deployments, attachment files can be directly downloaded via the leaked URLs, potentially exposing passwords, personal data, and authentication credentials that could enable account compromise or lateral movement (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires a valid authenticated session (low-privilege user JWT) and knowledge of a target cipher's UUID, making opportunistic mass exploitation less likely but targeted insider or multi-tenant attacks feasible. The EPSS score is approximately 0.025% (0.04% per GitHub Advisory), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Obtain authentication: Log in to the target Vaultwarden instance as a regular user to obtain a valid Bearer JWT token.
2. Enumerate cipher IDs: Identify target cipher UUIDs belonging to other users. These may be discoverable through organization membership, shared collections, or by observing cipher IDs in API responses during normal use.
3. Baseline check: Confirm that a standard GET /api/ciphers/{victim_cipher_id} request returns a 403 Forbidden or equivalent denial, verifying the target cipher is not accessible via normal means.
4. Exploit the partial update endpoint: Send a PUT /api/ciphers/{victim_cipher_id}/partial request with the attacker's Bearer token and a minimal JSON body (e.g., {"favorite": false, "folderId": null}).
5. Extract cipher details: Parse the 200 OK response body, which contains cipherDetails including name, notes, data, secureNote, and attachments[].url.
6. Download attachments: Use the returned tokenized URL (filesystem) or pre-signed URL (object storage) to directly download attachment files belonging to the victim (GitHub Advisory).

• Network/Logs: Repeated PUT /api/ciphers/{id}/partial requests from a single authenticated user targeting multiple different cipher UUIDs, especially UUIDs not associated with that user's own vault entries.
• Logs: HTTP access logs showing 200 OK responses to PUT /api/ciphers/*/partial for cipher IDs that return 403 on GET /api/ciphers/* from the same user session.
• Network: Unusual outbound requests to attachment download endpoints (/attachments/<cipher_id>/<attachment_id>?token=...) or pre-signed object storage URLs originating from unexpected client IPs.
• Application Logs: Vaultwarden log entries showing Cipher ownership assertion failure errors (from src/db/models/cipher.rs) may indicate the to_json method encountered access restriction anomalies during exploitation (GitHub Advisory).

Upgrade Vaultwarden to version 1.35.4 or later, which adds the missing authorization check (is_write_accessible_to_user) to the put_cipher_partial handler, consistent with the standard update API. No configuration-based workaround is available for versions prior to 1.35.4; the only remediation is upgrading. Administrators of multi-user Vaultwarden instances should treat this as a priority update given the sensitivity of vault data (GitHub Advisory, Red Hat Bugzilla).

Security Online Info published a write-up titled "Vault Unlocked: High-Severity Flaws in Vaultwarden Expose Encrypted Secrets and Allow Privilege Escalation," highlighting this and related vulnerabilities in Vaultwarden (Security Online). The vulnerability was reported by researcher odgrso and remediated by Vaultwarden maintainer BlackDex, with the advisory published promptly on the same day as the fix. Community discussion was noted on Bluesky and other aggregator platforms shortly after disclosure, reflecting the active self-hosted password manager community's attention to the issue (GitHub Advisory).