Is CVE-2026-33420 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33420 being exploited in the wild.

How severe is CVE-2026-33420?

Medium severity, with a CVSS score of 5.3, published 5 May 2026.

Which products and versions are affected?

dani-garcia Vaultwarden <= 1.35.4.

Is there a fix for CVE-2026-33420?

A patch was published on 2026-04-12: Version 1.35.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33420 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-33420?

Check whether you run Dani-Garcia Vaultwarden. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33420: Vaultwarden missing authorization check in get_org_collections_details

Q: Is there a fix for CVE-2026-33420?

A patch was published on 2026-04-12: Version 1.35.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33420 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-33420?

Check whether you run Dani-Garcia Vaultwarden. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33420 · Severity: medium · CVSS 5.3 · Published 2026-05-05

Vaultwarden is an open-source password management server. A security flaw allows users with a 'Manager' role to view information about all password collections within an organization, even if they haven't been granted permission to see them. This could allow an internal user to see sensitive collection names and identify which employees have access to specific sets of credentials.

Technologies: Dani-Garcia Vaultwarden. Vendors: Dani-Garcia.

Quick answers

Is CVE-2026-33420 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33420 being exploited in the wild.
How severe is CVE-2026-33420?: Medium severity, with a CVSS score of 5.3, published 5 May 2026.
Which products and versions are affected?: dani-garcia Vaultwarden <= 1.35.4.
Is there a fix for CVE-2026-33420?: A patch was published on 2026-04-12: Version 1.35.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33420 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-33420?: Check whether you run Dani-Garcia Vaultwarden. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The 'get_org_collections_details' endpoint (GET /api/organizations/{org_id}/collections/details) in 'src/api/core/organizations.rs' fails to implement the 'has_full_access()' authorization check. While the sibling 'get_org_collections' endpoint correctly restricts access, this specific endpoint only requires 'ManagerHeadersLoose' and returns all collections via 'Collection::find_by_organization()'. An authenticated attacker with a Manager role can exploit this to retrieve collection names, UUIDs, and user/group-to-collection mappings for the entire organization, regardless of their specific assignments. This issue is fixed in version 1.35.5.

Affected products

dani-garcia Vaultwarden <= 1.35.4

Timeline

2026-04-26: advisory: GitHub Security Advisory published
2026-05-05: disclosed: CVE published to NVD
2026-04-12: patched: Version 1.35.5 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.