{"action":"Upgrade vaultwarden to 1.35.4 or later.","affected":[{"fixed":"1.35.4","introduced":"0"}],"component":"vaultwarden","cve_ids":["CVE-2026-27803"],"ecosystem":"crates.io","epss":0.00304,"exploited":false,"fixed_versions":["1.35.4"],"ghsa_id":"GHSA-h4hq-rgvh-wh27","id":"tcs_01M5KF09SH4FXWCHFQDT64AVEV","modified_at":"2026-03-04T20:41:20.105214Z","published_at":"2026-03-04T20:13:44Z","references":["https://osv.dev/vulnerability/GHSA-h4hq-rgvh-wh27","https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h4hq-rgvh-wh27","https://github.com/dani-garcia/vaultwarden"],"severity":{"label":"high","score":8.3},"sources":[{"source":"osv","source_id":"GHSA-h4hq-rgvh-wh27","url":"https://osv.dev/vulnerability/GHSA-h4hq-rgvh-wh27"}],"summary":"Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role"}