Executive brief
Vaultwarden is an open-source password management server compatible with the Bitwarden ecosystem. A security flaw allows a user who has been invited as an organization owner, but not yet fully confirmed by an existing administrator, to permanently delete the entire organization's vault. This results in the immediate and irreversible loss of all shared passwords, credentials, and file attachments for the affected organization.
Technical details
An authorization bypass exists in the 'POST /api/ciphers/purge' endpoint of Vaultwarden. The application uses a two-step invitation process where a user transitions from 'Invited' to 'Accepted' upon accepting an invite, and finally to 'Confirmed' after administrator approval. The vulnerable endpoint verifies that a user has the 'Owner' role but fails to check if their membership status is 'Confirmed'. An authenticated attacker with 'Accepted' status can exploit this to hard-delete all ciphers and attachments within the organization. This vulnerability is addressed in version 1.35.5 by enforcing confirmed status checks on destructive organization-wide operations.
Affected products
- dani-garcia Vaultwarden <= 1.35.4
Timeline
- 2026-04-25: advisory: GitHub security advisory published by maintainers
- 2026-05-11: disclosed: CVE-2026-43913 published to NVD
- 2026-05-11: patched: Fix released in version 1.35.5