Vaultwarden Vulnerabilities Enable Privilege Escalation and Data Exposure

Two high-severity authorization vulnerabilities (CVE-2026-27803 and CVE-2026-27802) were disclosed in Vaultwarden 1.35.3: one permits Manager accounts to bypass collection management restrictions and perform administrative actions despite manage=false, and the other allows privilege escalation via the bulk-access API to gain access_all privileges. Both are network-exploitable with low complexity and no user interaction; administrators are urged to upgrade to Vaultwarden 1.35.4 immediately.