The vulnerability allows an authenticated regular user to supply another user's cipher identifier to the partial update endpoint. Although the standard retrieval API correctly blocks such access, the update endpoint returns a 200 OK response and leaks the full cipher details—including name, notes, data, and secure note information—effectively enabling the attacker to read confidential data belonging to a different user. This issue stems from an authorization bypass (CWE-639) and represents a moderate severity confidentiality violation as the attacker gains unauthorized read access to encrypted data without modifying or deleting it.

Vaultwarden, an unofficial Bitwarden-compatible server written in Rust, is affected when running any version older than 1.35.4. The vulnerability applies to all deployments of the dani-garcia:vaultwarden product, regardless of the environment or configuration, as long as the user is authenticated and has a valid session.

Based on the description, the likely attack vector is an authenticated user sending a request to the partial update API with a chosen cipher identifier. The CVSS score of 5.4 reflects moderate risk, while the EPSS score is less than 1 %, indicating a very low likelihood of widespread exploitation at present. The vulnerability is not classified in the CISA KEV catalog. The attack likely requires a legitimate authenticated user who can interact with the Vaultwarden API. Since the partial update endpoint accepts a cipher identifier, a malicious user can enumerate or guess valid identifiers or target known IDs. The internal exploit does not require elevated privileges or external network exposure, making the risk mainly confined to environments where user accounts are actively used.