Advisory · CVE-2026-95814
Revoked Vaultwarden organization members keep full cipher access
Vaultwarden through 1.37.3 fails to validate organization membership status in cipher access queries, so revoked and unconfirmed members retain read, write, delete, and attachment access to organization secrets. CVSS 8.6.
- Vendor
- Vaultwarden
- Product
- Vaultwarden
- Identifier / CWE
- CVE-2026-95814
CWE-863 - Action timing
- Immediate
Explain it like I’m five
A company revokes an employee's badge but forgets to change the safe combination. The ex-employee walks back in and opens the safe, because the safe never checks badges.
- 01Membership revoked
An organization admin revokes or declines to confirm a member's Vaultwarden organization membership.
- 02Rows retained
The underlying users_collections and groups_users rows are kept, and the cipher access queries never check membership status.
- 03Access retained
The revoked or pending member calls the direct-by-UUID cipher endpoints.
- 04Secrets exposed
They retain read, write, delete, attachment, and collection-move access to organization ciphers server-side.
What happened
A disclosure reports that Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries (get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group). Revoked and not-yet-confirmed members therefore retain read, write, delete, and attachment access to organization ciphers. The upstream project has a fix proposed in pull request #7554, which requires a confirmed membership in the cipher’s organization in all three queries. NVD rates it CVSS 8.6 (v3.1).
What to do
- Track the upstream Vaultwarden release containing the PR #7554 fix and upgrade self-hosted instances promptly; the pull request was still open at the time of writing.
- Audit organization membership lists and confirm no revoked or pending members remain.
- Review cipher access logs for activity by revoked or unconfirmed members.
- Rotate any organization secrets that revoked members could have reached.
Management note
Offboarding that does not actually revoke access is a standing insider risk, and here it affects the password manager itself. Until the upstream release ships, manual membership audits are the control.