Is CVE-2026-95814 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95814 being exploited in the wild.

How severe is CVE-2026-95814?

High severity, with a CVSS score of 8.1, published 22 September 2026.

Which products and versions are affected?

Dani-Garcia Vaultwarden through 1.37.3.

Is there a fix for CVE-2026-95814?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-95814 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-95814?

Check whether you run Dani-Garcia Vaultwarden at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95814: Vaultwarden authorization bypass in cipher access queries

CVE-2026-95814 · Severity: high · CVSS 8.1 · Published 2026-09-22

Vaultwarden is a password manager server compatible with Bitwarden. An authorization flaw allows users whose organization membership has been revoked or is pending approval to retain access to sensitive password vaults and encrypted data. An attacker could exploit this to access, modify, or delete secrets belonging to the organization even after their membership should have been terminated.

Technologies: Dani-Garcia Vaultwarden. Vendors: Dani-Garcia.

Quick answers

Is CVE-2026-95814 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95814 being exploited in the wild.
How severe is CVE-2026-95814?: High severity, with a CVSS score of 8.1, published 22 September 2026.
Which products and versions are affected?: Dani-Garcia Vaultwarden through 1.37.3.
Is there a fix for CVE-2026-95814?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-95814 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-95814?: Check whether you run Dani-Garcia Vaultwarden at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Three cipher access-restriction queries (get_user_collections_access_flags, get_group_collections_access_flags, is_in_full_access_group) fail to validate organization membership status, permitting revoked and pending members to bypass access controls. The vulnerability is exploitable server-side without user interaction; attackers with former or pending organization membership can read, write, delete, and access attachments on protected organization ciphers.

Affected products

dani-garcia Vaultwarden through 1.37.3

Timeline

2026-09-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.