Vaultwarden 1.35.3 → 1.35.6
3 releases · 0 breaking changes · 7 security fixes · 5 advisories fixed
7security0breaking0deprecated5feature11fix
Vulnerabilities fixed by this upgrade
- 7.3 CVE-2026-43914 Brute-force protection bypass vulnerability
- 8.1 CVE-2026-43913 Unconfirmed Owner Can Purge Entire Organization Vault
- 8.7 CVE-2026-43912 Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
- 6.8 CVE-2026-43911 Refresh tokens not invalidated on security stamp rotation
- 4.3 CVE-2026-31835 Vaultwarden: WebAuthn assertion processed before signature verification allows persistent credential backup-flag tampering
Breaking changes
None in the release notes.
Security changes
- security GHSA-937x-3j8m-7w7p Unconfirmed Owner Can Purge Entire Organization Vault. in 1.35.5
- security GHSA-569v-845w-g82p Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization in 1.35.5
- security GHSA-6j4w-g4jh-xjfx Refresh tokens not invalidated on security stamp rotation in 1.35.5
- security Fixes CVE-2026-43914: Brute-force protection bypass vulnerability in 1.35.4
- security GHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID. in 1.35.4
- security GHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them. in 1.35.4
- security GHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned. in 1.35.4
Every release in between
fixFix MFA Remember
securityGHSA-937x-3j8m-7w7p Unconfirmed Owner Can Purge Entire Organization Vault.
securityGHSA-569v-845w-g82p Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
securityGHSA-6j4w-g4jh-xjfx Refresh tokens not invalidated on security stamp rotation
otherThe admin templates have changed, please update them if you override these via templates.
otherTwo Factor Remember Tokens are now valid for max 30 days. Old tokens are invalid directly after upgrading.
otherapply policies only to confirmed members
featureFeat(config): add feature flag for Safari account switching
fixfix: add ForcePasswordReset to api key login
featureAdd Webauthn related origins flag to known flags.
featureAdd 30s cache to SSO exchange_refresh_token
featureAdd cxp-import-mobile and cxp-export-mobile: feature flags on mobile
otherMisc updates and fixes
featureSupport new desktop origin on CORS
fixFix checkout action version
fixFix apikey login
fixFix email header base64 padding
otherUpdate Feature Flags
otherUpdate crates and GHA
otherUse protected CI environment
fixFix 2FA Remember to actually be 30 days
otherMisc Updates
otherSwitch to attest action
otherRotate refresh-tokens on sstamp reset
otherMisc org fixes
fixFix empty string FolderId
otherDisable deployments for release env
fixFix Send icons
otherprevent managers from creating collections
otherChange SQLite backup to use VACUUM INTO query
otherHandle SIGTERM and SIGQUIT shutdown signals.
otherDo not display unavailable 2FA options
fixFix logout push identifiers and send logout before clearing devices
fixFix windows build issues
otherCrate and GHA updates
securityFixes CVE-2026-43914: Brute-force protection bypass vulnerability
securityGHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.
securityGHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.
securityGHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.
otherUpdate Rust and Crates and GHA
otherhide remember 2fa token
fixfix(send_invite): invite links
otherMisc organization fixes