Vaultwarden, an unofficial Bitwarden-compatible server written in Rust, contains a privilege escalation vulnerability prior to version 1.35.4. The vulnerability allows Managers with manage=false permissions for a collection to still perform management operations if they have access to that collection. This represents an access control bypass that could allow unauthorized administrative actions. The issue has been patched in version 1.35.4.