CVE-2026-43912 is an improper authorization vulnerability (CWE-285) in Vaultwarden before version 1.35.5. The issue occurs because the application does not enforce consistency checks between organization membership UUIDs and group or collection UUIDs. An attacker who is an admin in Organization A and a low-privileged member in Organization B can bind Organization B membership UUIDs into Organization A groups. This allows the attacker to enumerate and access Organization B's vault data through Organization A's elevated privileges, including reading and writing vault items. The vulnerability is resolved in Vaultwarden 1.35.5.

An attacker with admin rights in one organization and low privileges in another can gain unauthorized read and write access to vault data in the second organization by exploiting improper authorization checks. This leads to a complete compromise of confidentiality and integrity of the affected organization's vault data. Availability is not impacted. The CVSS 3.1 base score is 8.7 (High), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality and integrity.

This vulnerability is fixed in Vaultwarden version 1.35.5. Users should upgrade to version 1.35.5 or later to remediate this issue. No other official remediation or temporary fixes are documented. Since this is not a cloud service, patching the affected software is required to mitigate the risk.