CVE-2026-95814

Name of the Vulnerable Software and Affected Versions Vaultwarden versions prior to 1.37.4

Description Organization membership status validation is omitted from three cipher access-restriction queries. This allows members with revoked or not-yet-confirmed status to maintain read, write, delete, and attachment access to organization ciphers. The issue occurs server-side due to missing status filters in the following functions: get user collections access flags(), get group collections access flags(), and is in full access group().

Recommendations Update to version 1.37.4 or later.