# Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

Vaultwarden's bulk-access API skipped per-collection authorization, letting a Manager add themselves to unassigned collections and read or alter restricted secrets.

- Payout: Research
- Severity: high
- Program: Vaultwarden
- Found by: odgrso
- Disclosed: 2026-03-04
- CVE: CVE-2026-27802
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-r32r-j5jq-3w4m
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-r32r-j5jq-3w4m
- Tags: area:web domain:api domain:web impact:data-leak impact:integrity impact:privesc kind:research platform:ghsa sev:high technique:source-review vuln:access-control vuln:auth-bypass vuln:idor vuln:privilege-escalation

**Target:** Bulk collection access API endpoint (/organizations collections bulk-access)
**Root cause:** The bulk-access endpoint uses ManagerHeadersLoose and iterates collection_ids without calling can_access_collection, unlike the single-update path that enforces per-collection authorization.
**Steps:**
1. Log in as a Manager (access_all=false) and obtain a Bearer token.
2. Confirm target collection's assigned/manage/readOnly/hidePasswords values.
3. Verify standard update API returns 401 Unauthorized for the unassigned collection.
4. Invoke bulk-access API with `collectionIds` containing the target collection and `users` containing the attacker's own `membership_id`; observe 200 OK.
5. Re-run the standard update API; it now returns 200 OK and the modification is applied.
**How found:** Reporter compared the bulk-access endpoint (ManagerHeadersLoose, no per-collection check) against another bulk endpoint that calls ManagerHeaders::from_loose and against can_access_collection in auth.rs; confirmed the gap by observing 401 before and 200 after the bulk call.
**Exploitation:** A Manager with access_all=false calls the bulk-access endpoint directly, passing the target collection ID and their own membership_id, which flips assigned=false to assigned=true and grants access; the same call deletes existing group and user assignments, enabling sabotage.
**Escalation:** Bulk update deletes existing CollectionGroup and CollectionUser assignments, letting the attacker strip other users' access (DoS/sabotage) in addition to self-granting access.
**Insight:** When a codebase has both single-item and bulk endpoints for the same resource, diff their authorization middleware: bulk handlers often use a looser header extractor and loop over IDs without per-item checks.