A flaw in Vaultwarden’s group management allows an administrator in one organization to bind a membership or collection UUID from another organization into a group of the first organization. The flaw is a case of improper authorization (CWE‑285) that lets the attacker read and possibly write data from the target organization. The attacker can use an Org‑wide group with the accessAll flag to sync and enumerate collections, then bind those collection IDs through the same vulnerability to gain write access to items in the other organization.

The vulnerability affects the Vaultwarden project developed by dani‑garcia. It impacts all releases prior to 1.35.5; versions 1.35.5 and later contain the necessary checks that enforce organization consistency for group and collection relationships.

The CVSS score of 8.7 classifies the issue as high severity. EPSS data is not available, so the probability of exploitation cannot be quantified from that metric, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the issue by interacting with group‑management endpoints that accept arbitrary MembershipId and CollectionId values without verifying organization consistency; no additional privileges beyond being an organization administrator and a low‑level member in the target organization are required.