Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager
Date: 2026-03
Affected: rust/vaultwarden
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-27802
CWE: CWE-269
CWE-863
CVSS: 8.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)

## Summary A Manager account (`access_all=false`) was able to escalate privileges by directly invoking the **bulk-access API** against collections that were not originally assigned to them. The API allowed changing `assigned=false` to `assigned=true`, resulting in unauthorized access. Additionally, prior to the bulk-access call, the regular single-update API correctly returned **401 Unauthorized** for the same collection. After executing the bulk-access API, the same update API returned **200 OK**, confirming an authorization gap at the HTTP level. --- ## Description * The endpoint accepts `ManagerHeadersLoose` and does not validate access rights for the specified `collectionIds`. src/api/core/organizations.rs:551 ```rust headers: ManagerHeadersLoose, ``` * The received `collection_ids` are processed directly without per-collection authorization checks. src/api/core/organizations.rs:564 ```rust for col_id in data.collection_ids { ``` * Existing group assignments for the collection are deleted. src/api/core/organizations.rs:583 ```rust CollectionGroup::delete_all_by_collection(&col_id, &conn).await?; ``` * Existing user assignments for the collection are deleted. src/api/core/organizations.rs:590 ```rust CollectionUser::delete_all_by_collection(&col_id, &conn).await?; ``` * By comparison, another bulk-processing endpoint performs per-collection validation using `from_loose`. src/api/core/organizations.rs:787 ```rust let heade


Mitigations:

Architectural layers (MAESTRO):