Vaultwarden, an unofficial Bitwarden compatible server, suffers from a privilege escalation flaw that allows a Manager to perform bulk permission updates on collections they are not authorized to access. This defect enables an authenticated Manager to grant access to confidential data or elevate other users’ privileges without proper authorization. The vulnerability is rooted in a flaw in the permission update logic, which is categorized under CWE‑266, CWE‑269, and CWE‑863.

All installations of Vaultwarden prior to version 1.35.4 are affected. The vulnerability applies to the officially published releases by the maintainer, dani‑garcia. Users running any older release of the server should confirm whether the build includes the unpatched logic and consider upgrading to a fixed version.

The flaw scores an 8.3 on the CVSS scale, indicating a high severity and wide impact if leveraged. The EPSS score is less than 1 %, suggesting that the probability of public exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. An attacker who has performed a Manager‑level authentication can exploit the flaw by sending a bulk permission update request to the API; no other special conditions are documented in the advisory. While the likelihood is currently low, the high severity warrants immediate attention.