vaultwarden, an unofficial Bitwarden-compatible server, contains an authenticated flaw that allows any organization member to retrieve all ciphers within an organization, disregarding collection permissions. This exposes confidential data such as passwords, notes, and encrypted secrets, providing attackers with a full set of organizational credentials. The weakness stems from a permissive use of Cipher::find_by_org without enforcing collection-level checks, and is classified as CWE‑1220 and CWE‑863.

Instances of vaultwarden running any version prior to 1.35.3 are affected. The vulnerability exists in all releases from the earliest stable build up to 1.35.2 and is resolved in v1.35.3 and later. Administrators should verify the running image tag or package version to determine exposure.

The CVSS base score of 6.5 indicates a medium impact, while an EPSS score of less than 1% suggests a very low likelihood of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers require legitimate authentication as an organization member to exploit the flaw, using the /ciphers/organization-details endpoint to gain unrestricted access to all ciphers without additional privileges or network compromise.