{"id":"GHSA-h4hq-rgvh-wh27","summary":"Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role","details":"## Summary\n\nTesting confirmed that even when a Manager has `manage=false` for a given collection, they can still perform the following management operations as long as they have access to the collection:\n\n* `PUT /api/organizations/\u003corg_id\u003e/collections/\u003ccol_id\u003e` succeeds (HTTP 200)\n* `PUT /api/organizations/\u003corg_id\u003e/collections/\u003ccol_id\u003e/users` succeeds (HTTP 200)\n* `DELETE /api/organizations/\u003corg_id\u003e/collections/\u003ccol_id\u003e` succeeds (HTTP 200)\n\n\n\n## Description\n\n* The Manager guard checks only whether the user **can access the collection**, not whether they have `manage` privileges. This check is directly applied to management endpoints.\nsrc/auth.rs:816\n  ```rust\n\n  if !Collection::can_access_collection(&headers.membership, &col_id, &conn).await {\n      err_handler!(\"The current user isn't a manager for this collection\")\n  }\n  ```\n\n* The `can_access_collection` function does **not** evaluate the `manage` flag.\n  src/db/models/collection.rs:140\n\n  ```rust\n\n  pub async fn can_access_collection(member: &Membership, col_id: &CollectionId, conn: &DbConn) -\u003e bool {\n      member.has_status(MembershipStatus::Confirmed)\n          && (member.has_full_access()\n              || CollectionUser::has_access_to_collection_by_user(col_id, &member.user_uuid, conn).await\n              || ...\n  ```\n\n* A separate management-permission check exists and includes `manage` validation, but it is **not used** during authorization for the affected endpoints.\n  src/db/models/collection.rs:516\n\n  ```rust\n\n  pub async fn is_manageable_by_user(&self, user_uuid: &UserId, conn: &DbConn) -\u003e bool {\n      let Some(member) = Membership::find_confirmed_by_user_and_org(user_uuid, &self.org_uuid, conn).await else {\n          return false;\n      };\n      if member.has_full_access() {\n          return true;\n      }\n      ...\n  ```\n\n* The actual update and deletion endpoints only accept `ManagerHeaders` and do not perform additional `manage` checks.\n  src/api/core/organizations.rs:608\n\n```rust\n  async fn put_organization_collection_update(..., headers: ManagerHeaders, ...)\n```\n\n  src/api/core/organizations.rs:890\n\n```rust\n  async fn put_collection_users(..., headers: ManagerHeaders, ...)\n```\n  \n\nsrc/api/core/organizations.rs:747\n\n```rust\n  async fn delete_organization_collection(..., headers: ManagerHeaders, ...)\n  ```\n\n\n\n## Preconditions\n\n* The attacker is a **Manager** within the target organization.\n* The attacker has access to the target collection (`assigned=true`).\n* The attacker’s permission for that collection is `manage=false`.\n* A valid API access token has been obtained.\n\n\n\n## Steps to Reproduce\n\n1. Confirm that the attacker’s current permissions for the target collection include `manage=false`.\n\u003cimg width=\"2015\" height=\"636\" alt=\"image\" src=\"https://github.com/user-attachments/assets/58ddc733-e37c-4766-a980-b1ea1918ceb4\" /\u003e\n\n2. As a control test, verify that update operations fail for collections the attacker cannot access.\n\u003cimg width=\"2021\" height=\"852\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d8699442-2dfc-4d73-8940-ec10f4a175f0\" /\u003e\n\n3. Confirm that update operations succeed for the target collection where `manage=false`.\n\u003cimg width=\"2013\" height=\"690\" alt=\"image\" src=\"https://github.com/user-attachments/assets/33d9845d-d18e-456c-a58c-e780911347a9\" /\u003e\n\n4. Use `PUT /collections/{col_id}/users` to set `manage=true`, confirming that the attacker can escalate their own privileges.\n\u003cimg width=\"2018\" height=\"488\" alt=\"image\" src=\"https://github.com/user-attachments/assets/da8c5246-cf2a-46c2-9a25-e99d907f852d\" /\u003e\n\n5. Verify that deletion of the collection succeeds despite the Manager lacking management rights.\n\u003cimg width=\"2018\" height=\"487\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a97c8fb2-4f97-4c2a-a90b-9d95dbde84fd\" /\u003e\n\n\n\n## Required Minimum Privileges\n\n* Organization Manager role (Owner/Admin privileges are not required)\n* Works even with `access_all=false`\n* Only access rights to the target collection are required (`manage` privilege is not required)\n\n\n\n## Attack Scenario\n\nA restricted Manager (intended for read/use-only access) directly invokes the API to update collection settings, elevate their own privileges to `manage=true`, and even delete the collection.\n\nThis allows the user to bypass operational access restrictions and effectively gain administrator-equivalent control over the collection.\n\n\n\n## Potential Impact\n\n* **Confidentiality:** Expansion of access scope through unauthorized privilege escalation and configuration changes.\n* **Integrity:** Unauthorized modification of collection settings and assignments; potential disabling of access controls.\n* **Availability:** Deletion of collections may disrupt business operations.","aliases":["CVE-2026-27803"],"modified":"2026-03-04T20:41:20.105214Z","published":"2026-03-04T20:13:44Z","database_specific":{"github_reviewed_at":"2026-03-04T20:13:44Z","nvd_published_at":null,"cwe_ids":["CWE-269","CWE-285","CWE-863"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h4hq-rgvh-wh27"},{"type":"PACKAGE","url":"https://github.com/dani-garcia/vaultwarden"}],"affected":[{"package":{"name":"vaultwarden","ecosystem":"crates.io","purl":"pkg:cargo/vaultwarden"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.35.4"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 1.35.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-h4hq-rgvh-wh27/GHSA-h4hq-rgvh-wh27.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"}]}