# CVE-2026-33420: Vaultwarden missing authorization check in get_org_collections_details

Source: https://junglewise.ai/threats/cve-2026-33420-vaultwarden-missing-authorization-check-in-get-org-collections  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-33420 · Severity: medium · CVSS 5.3 · Published 2026-05-05

Vaultwarden is an open-source password management server. A security flaw allows users with a 'Manager' role to view information about all password collections within an organization, even if they haven't been granted permission to see them. This could allow an internal user to see sensitive collection names and identify which employees have access to specific sets of credentials.

Technologies: [Dani-Garcia Vaultwarden](https://junglewise.ai/threats/technologies/vaultwarden). Vendors: [Dani-Garcia](https://junglewise.ai/threats/vendors/dani-garcia).

## Quick answers

**Is CVE-2026-33420 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33420 being exploited in the wild.

**How severe is CVE-2026-33420?** Medium severity, with a CVSS score of 5.3, published 5 May 2026.

**Which products and versions are affected?** dani-garcia Vaultwarden <= 1.35.4.

**Is there a fix for CVE-2026-33420?** A patch was published on 2026-04-12: Version 1.35.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33420 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-33420?** Check whether you run Dani-Garcia Vaultwarden. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The 'get_org_collections_details' endpoint (GET /api/organizations/{org_id}/collections/details) in 'src/api/core/organizations.rs' fails to implement the 'has_full_access()' authorization check. While the sibling 'get_org_collections' endpoint correctly restricts access, this specific endpoint only requires 'ManagerHeadersLoose' and returns all collections via 'Collection::find_by_organization()'. An authenticated attacker with a Manager role can exploit this to retrieve collection names, UUIDs, and user/group-to-collection mappings for the entire organization, regardless of their specific assignments. This issue is fixed in version 1.35.5.

## Affected products

- dani-garcia Vaultwarden <= 1.35.4

## Timeline

- 2026-04-26: advisory: GitHub Security Advisory published
- 2026-05-05: disclosed: CVE published to NVD
- 2026-04-12: patched: Version 1.35.5 released

## References

- [https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.5](https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.5)
- [https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jjxg-p3v6-52ww](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jjxg-p3v6-52ww)

## Related threats

- [Vaultwarden authorization bypass in cipher access queries](https://junglewise.ai/threats/cve-2026-95814-vaultwarden-through-1-37-3-omits-organization-membership-status)
- [Vaultwarden account takeover via unverified SSO email linking](https://junglewise.ai/threats/cve-2026-47164-vaultwarden-account-takeover-via-unverified-sso-email-linking)
- [Vaultwarden information disclosure in SSO discovery flow](https://junglewise.ai/threats/cve-2026-47159-vaultwarden-information-disclosure-in-sso-discovery-flow)
- [Vaultwarden incorrect authorization in organization vault purge](https://junglewise.ai/threats/cve-2026-43913-vaultwarden-incorrect-authorization-in-organization-vault-purge)
- [Vaultwarden improper authorization in cross-org group binding](https://junglewise.ai/threats/cve-2026-43912-vaultwarden-improper-authorization-in-cross-org-group-binding)