CVE-2026-43913

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flow uses a two-step process: accepting an invite transitions membership from Invited to Accepted, and a separate confirmation by an existing owner upgrades it to Confirmed. The POST /api/ciphers/purge endpoint uses plain Headers and only checks that the membership type is Owner without verifying that the membership status is Confirmed. An authenticated user who has been invited as an organization owner and has accepted the invite and has not yet been confirmed can call this endpoint to hard-delete all ciphers and attachments in the organization, causing immediate organization-wide data loss. This vulnerability is fixed in 1.35.5.

• CWE-863

• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-937x-3j8m-7w7pExploit, Mitigation, Vendor Advisory

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43908OpenImageIO is a toolset for reading, writing, and manipulat…8.8
• CVE-2026-43909OpenImageIO is a toolset for reading, writing, and manipulat…8.8
• CVE-2026-4391A security vulnerability has been detected in TeamSpeak 3 Se…6.9
• CVE-2026-43910Appium Java Client is the Java language binding for writing …8.2
• CVE-2026-43911Vaultwarden is a Bitwarden-compatible server written in Rust…8.1
• CVE-2026-43912Vaultwarden is a Bitwarden-compatible server written in Rust…8.7
• CVE-2026-43914Vaultwarden is a Bitwarden-compatible server written in Rust…9.8
• CVE-2026-43915Coturn is a free open source implementation of TURN and STUN…5.4
• CVE-2026-43916pam_authnft is a PAM session module binding nftables firewal…8.7
• CVE-2026-43917Dokploy is a free, self-hostable Platform as a Service (PaaS…5.3
• CVE-2026-43918FOSSBilling is a free, open-source billing and client manage…8.7
• CVE-2026-43919Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…