Disclaimer: Automated heuristics over public release notes and vulnerability databases (OSV / NVD). Can be wrong or incomplete. Always back up first and validate upgrades yourself. Stack Watch does not invent CVE IDs or issue counts. This is an MVP research project, not a live paid service.

Home / Vaultwarden / 1.37.4

Vaultwarden 1.37.4

UPDATE_WITH_CARE

Security-related language in release notes; update after a backup if you are affected.

Published: 2026-10-06T11:30:54Z · GitHub release

Summary of changes

## Security Fixes This release contains security fixes for the following advisories. We strongly advise updating as soon as possible. - Organization member revocation [GHSA-69q9-v8p6-xvx3] (High, 8.1) - Two-factor authentication [GHSA-7jg8-8m5x-6j9r] (Medium, 6.8) - Organization invitations [GHSA-v576-3wvq-xh3c] (Medium, 6.8) - Attachments [GHSA-q5x6-grh5-fqgc] (Medium, 6.5) - Organization event logs [GHSA-64mc-4p6f-r7x9] (Medium, 4.3) - Cipher sharing [GHSA-7ccc-c43j-4p36] (Medium, 4.3) - Organization API key [GHSA-qwx4-wcv4-mpcv] (Low, 3.8) - Additional dependency updates and minor security enhancements These are private for now, pending CVE assignment and publishing at a later date. Note If an organization has Admins you don't fully trust, consider rotating its API key after updating (Admin Console → Settings → Rotate API key). Before this release, Admins could also view the key. …

Breaking changes

None detected by heuristics.

CVEs linked to this release

None linked from release notes or OSV fixed-in match.

Linked issues / PRs mentioned

Back up first

Always back up first. Stack Watch briefs are automated heuristics over public release notes and vulnerability databases. They can be wrong or incomplete. You are responsible for validating upgrades in your own environment. We never invent CVE IDs or issue counts — if a number is missing, it was not found.