{"action":"Upgrade vaultwarden to 1.35.4 or later.","affected":[{"fixed":"1.35.4","introduced":"0"}],"component":"vaultwarden","cve_ids":["CVE-2026-27898"],"ecosystem":"crates.io","epss":0.00192,"exploited":false,"fixed_versions":["1.35.4"],"ghsa_id":"GHSA-w9f8-m526-h7fh","id":"tcs_01M5KF3ZR2PTFAW886A1FY6H6G","modified_at":"2026-03-04T20:41:19.470123Z","published_at":"2026-03-04T20:14:06Z","references":["https://osv.dev/vulnerability/GHSA-w9f8-m526-h7fh","https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w9f8-m526-h7fh","https://github.com/dani-garcia/vaultwarden"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-w9f8-m526-h7fh","url":"https://osv.dev/vulnerability/GHSA-w9f8-m526-h7fh"}],"summary":"Vaultwarden has Unauthorized Access via Partial Update API on Another User’s Cipher"}