# Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role

Vaultwarden Manager role with manage=false could still update, reassign users on, and delete collections, escalating own privileges to manage=true.

- Payout: Research
- Severity: high
- Program: Vaultwarden
- Found by: odgrso
- Disclosed: 2026-03-04
- CVE: CVE-2026-27803
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-h4hq-rgvh-wh27
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-h4hq-rgvh-wh27
- Tags: area:web domain:api domain:web impact:integrity impact:privesc kind:research platform:ghsa sev:high tech:rust technique:source-review vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** Vaultwarden REST API collection management endpoints
**Root cause:** ManagerHeaders guard only calls Collection::can_access_collection, which checks membership/access but not the manage flag; the manage-aware is_manageable_by_user is never invoked on update/delete/user-assignment endpoints.
**Steps:**
1. As a Manager with manage=false on a target collection, send `PUT /api/organizations/<org_id>/collections/<col_id>` — returns 200.
2. Send `PUT /api/organizations/<org_id>/collections/<col_id>/users` to set own `manage=true` — returns 200, self-escalation.
3. Send `DELETE /api/organizations/<org_id>/collections/<col_id>` — returns 200 despite lacking manage rights.
**How found:** Reporter compared the Manager guard (can_access_collection) against the existing manage-aware is_manageable_by_user helper and noticed the latter was unused on the affected endpoints, then confirmed with control tests on accessible vs inaccessible collections.
**Exploitation:** A restricted Manager with only access rights (access_all=false, manage=false) directly calls the collection update, user-assignment, and delete endpoints with a valid API token; the ManagerHeaders guard passes because can_access_collection ignores manage, letting them rewrite settings, grant themselves manage=true, and delete the collection.
**Escalation:** Self-escalation from manage=false to manage=true via PUT /collections/{col_id}/users, yielding administrator-equivalent control over the collection.
**Insight:** When a codebase has both an access check and a separate manage/ownership check, grep for endpoints using the weaker guard — the presence of an unused stricter helper (is_manageable_by_user) is a strong signal of an authorization gap.