CVE-2026-33420

Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the get_org_collections_details endpoint (GET /api/organizations/{org_id}/collections/details) is missing the has_full_access() authorization check that exists on the sibling get_org_collections endpoint. This allows any Manager-role user with accessAll=False and no collection assignments to retrieve the names, UUIDs, user-to-collection mappings, and group-to-collection mappings for all collections in the organization. This issue has been fixed in version 1.35.5.

• CWE-862

• https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.5Product, Release Notes
• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jjxg-p3v6-52wwMitigation, Vendor Advisory

Published

May 5, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33415Discourse is an open-source discussion platform. From versio…2.7
• CVE-2026-33416LIBPNG is a reference library for use in applications that r…7.5
• CVE-2026-33417Wallos is an open-source, self-hostable personal subscriptio…7.1
• CVE-2026-33418DiceBear is an avatar library for designers and developers. …7.5
• CVE-2026-33419MinIO is a high-performance object storage system. Prior to …7.5
• CVE-2026-3342An Out-of-bounds Write vulnerability in WatchGuard Fireware …7.2
• CVE-2026-33421Parse Server is an open source backend that can be deployed …6.5
• CVE-2026-33422Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33423Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33424Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33425Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2026-33426Discourse is an open-source discussion platform. Prior to ve…3.8