CVE-2026-33420 is a missing authorization vulnerability (CWE-862) in Vaultwarden, a Bitwarden-compatible server written in Rust. Specifically, the GET /api/organizations/{org_id}/collections/details endpoint lacks the has_full_access() authorization check present in a related endpoint. This permits Manager-role users without full access to enumerate all collections' metadata within an organization. The vulnerability affects Vaultwarden versions prior to 1.35.5 and has a CVSS 4.0 base score of 5.3 (medium severity).

An attacker with Manager role but limited collection access can retrieve detailed organizational collection information, including collection names, UUIDs, and mappings of users and groups to collections. This exposure could aid in further reconnaissance or privilege escalation attempts within the organization. There is no indication of direct data modification or broader privilege escalation from this vulnerability alone.

Upgrade Vaultwarden to version 1.35.5 or later, where the missing authorization check has been implemented. Since this is an on-premises product, administrators must apply the update manually. Patch status is not explicitly stated but the vendor fixed the issue in 1.35.5, so applying this version is the recommended remediation.