Vaultwarden 1.36.0 → 1.37.0
1 version, 1 with upstream notes, vendor marks no changes as breaking, 0 required stops
Version by version, oldest first
1.37.0 2026-07-24
Note
Note
This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.
Note
Security Fixes
This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.
- SSRF via the icon endpoint [[GHSA-hw4g-2v3f-74x5]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5) [[GHSA-vh5m-fc9v-m84g]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-vh5m-fc9v-m84g) (Medium, 5.8 / 6.3)
- Cross-Organization Cipher Access [[GHSA-xwf8-pjh7-h589]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-xwf8-pjh7-h589) (Medium, 5.9)
- Organization Policy Bypass on Directory Import [[GHSA-88qc-6ch9-mc3j]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-88qc-6ch9-mc3j) (Medium, 5.5)
- Send Access-Count Bypass [[GHSA-rxhg-2pw9-vf25]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rxhg-2pw9-vf25) (Medium, 5.3)
- Unauthenticated WebSocket Flooding DDOS [[GHSA-96f7-78q5-j345]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-96f7-78q5-j345) (Medium, 5.3)
- Cross-Organization Secret Sharing [[GHSA-455c-vgg9-jxw8]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-455c-vgg9-jxw8) (Medium, 4.3)
- Organization Import Authorization [[GHSA-f3qw-qg77-hmm4]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-f3qw-qg77-hmm4)[[GHSA-jq2g-h4xr-4mcr]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jq2g-h4xr-4mcr) (Medium, 4.3)
- Organization Data Enumeration via the Manager role [[GHSA-rqf8-2568-r7mc]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rqf8-2568-r7mc) (Medium, 4.3)
These are private for now, pending CVE assignment and publishing at a later date.
Release notes from github.com/dani-garcia/vaultwarden/releases, checked 17 hours ago. Only text the vendor marks as breaking, or puts in a warning/caution/important note, is shown; read the full notes for anything else. Vaultwarden's release notes have no breaking-changes section. Sections titled Note, Notes, Notable changes, Important, General mention, Major changes, Other changes and Security Fixes, the Docker image notices of 1.16.0, 1.17.0 and 1.21.0, and paragraphs starting with ⚠️, are quoted instead, labelled “Note” or “Warning”.