Is CVE-2026-43913 actively exploited?

No active exploitation of CVE-2026-43913 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-43913 be exploited remotely?

Yes. CVE-2026-43913 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-43913?

CVE-2026-43913 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-43913

HIGH

CVE-2026-43913

CWE-863Published: May 11, 2026· Updated: May 13, 2026

8.1

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:10.9th

Official Description

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flow uses a two-step process: accepting an invite transitions membership from Invited to Accepted, and a separate confirmation by an existing owner upgrades it to Confirmed. The POST /api/ciphers/purge endpoint uses plain Headers and only checks that the membership type is Owner without verifying that the membership status is Confirmed. An authenticated user who has been invited as an organization owner and has accepted the invite and has not yet been confirmed can call this endpoint to hard-delete all ciphers and attachments in the organization,

causing immediate organization-wide data loss. This vulnerability is fixed in 1.35.5.

NVD Source

Technical Analysis

CVE-2026-43913 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.1.