CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

security/vaultwarden 1.37.4_1

Fixed in main, not merged to 2026Q4: Vaultwarden -- Multiple vulnerabilities

Bitwarden compatible backend server

Port info

Maintainer
mr@FreeBSD.org
Packages
latest: 1.37.4_1
Upstream
up to date
Last update
to 1.37.4_1 · 9c878207a1
Quarterly
2026Q4: 1.37.2_1 1 VuXML
Formerly
security/bitwarden_rs until 2021-05-16
WWW
https://github.com/dani-garcia/vaultwarden
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install vaultwarden
installs 1.37.4_1 from latest; from quarterly (2026Q4) 1.37.2_1
Port
# cd /usr/ports/security/vaultwarden && make install clean
# make -C /usr/ports/security/vaultwarden config  # change options first
Size
8.6 MiB download · 38 MiB installed
Depends on
archivers/zstd 1.5.7_2, databases/mysql84-client 8.4.11_1, databases/postgresql18-client 18.6, devel/capnproto 1.5.0, math/gmp 6.3.0, security/nettle 3.10.2, www/vaultwarden-web_vault 2026.7.0
License
GPLv3
Creates
user www, group www
Options
4 of 5 on in the package: MYSQL PGSQL SQLITE WEBVAULT
Show the 1 options that are off
S3

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.37.4_11.37.4–
FreeBSD 151.37.4_11.37.4_1–
FreeBSD 141.37.4_11.37.4✗

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.37.2_11.37.2_1–
FreeBSD 141.37.2_11.37.2_1✗

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.37.4_1.

Fixed (10)

Show 10 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-958148.62026-09-22Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members t…

Problem reports (1) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
298265maintainer-feedback? security/vaultwarden: empty dirs in etcNew2026-09-07

Commits (139)

Mikael Urankar (mikael) · 1.32.0_1
lang/rust: Bump revisions after 1.80.1

PR:		280490
7a55f95425
Mikael Urankar (mikael) · 1.32.0
security/vaultwarden: Fix build with rust 1.80.0

PR:		280490
a5d69cd830
Michael Reifenberger (mr) · 1.32.0
security/vaultwarden: Security update to 1.32.0

PR:		280258
Reported by:	Bernard Spil
c80fe7dcaf
Mikael Urankar (mikael) · 1.30.5_4
lang/rust: Bump revisions after 1.79.0

PR:		279707
21476ca8a9
Mikael Urankar (mikael) · 1.30.5_3
security/vaultwarden: Fix build with rust 1.79.0

PR:		279707
Approved by:	portmgr (build fix blanket)
2fbba8be22
Mikael Urankar (mikael) · 1.30.5_3
lang/rust: Bump revisions after 1.78.0

PR:		278834
2322b66100
Michael Reifenberger (mr) · 1.30.5_2
security/vaultwarden: Exclude i386 build
3b0aaecdbf
Mikael Urankar (mikael) · 1.30.5_1
lang/rust: Bump revisions after 1.77.0

PR:		277786
d632fbe55e
Michael Reifenberger (mr) · 1.30.5
security/vaultwarden: Update to 1.30.5

PR:		277596
Reported by:	brnrd@
830a7e41cc
Mikael Urankar (mikael) · 1.30.3_1
lang/rust: Bump revisions after 1.76.0

PR:		276920
7f5a7b0e52
Baptiste Daroussin (bapt) · 1.30.3
security/vaultwarden: fix packaging

The ownership can and should only be done in the plist never directly
in the make targets, make package should be executable as a regular user
and this is the case in the cluster)

PR:		276998
Reported by:	freebsd@rail.eu.org
f8bbc28c40
Michael Reifenberger (mr) · 1.30.3
security/vaultwarden: Update to 1.30.3

While there address PR:276739 by installing the static configfile sample
to etc/rc.conf.d/vaultwarden.sample since www/vaultwarden/data/config.json
is for dynamic changes via the UI.

PR:		276745, 276739
ee63c50e82
Bernard Spil (brnrd) · 1.30.1
security/vaultwarden: Update to 1.30.1

PR:		275394
Approved by:	Maintainer time-out
615bd55777
Mikael Urankar (mikael) · 1.30.0_2
lang/rust: Bump revisions after 1.75.0

PR:		276033
109c3d4629
Mikael Urankar (mikael) · 1.30.0_1
lang/rust: Bump revisions after 1.74.1

PR:		275243
b2afd89fb2
Robert Clausecker (fuz) · 1.30.0
security/vaultwarden: fix build on armv6/armv7 and i386

Disable LTO to avoid address space exhaustion.

Approved by:	portmgr (build fix blanket)
MFH:		2023Q4
a0dbba65ab
Bernard Spil (brnrd) · 1.30.0
security/vaultwarden: Optionsify database backends

* redo 687ab26524e52c866295a9ff5c7956fd5f71397f [1]
 * was reverted with 04ea2d6456297a759d2c3a887aa2001049397d7b [2]

PR:		274049 [1], 274962 [2]
4f5bbb33f2
Michael Reifenberger (mr) · 1.30.0
category/port: Update

Update security/vaultwarden to 1.28.0
Update www/vaultwarden-web_vault to 2023.10.0

PR:		274908, 274962
Reported by:	Bernard Spil
04ea2d6456
Bernard Spil (brnrd) · 1.29.2_1
security/vaultwarden: Optionsize database backends

PR:		274049
Approved by:	maintainer timeout
687ab26524
Mikael Urankar (mikael) · 1.29.2_1
lang/rust: Bump revisions after 1.73.0

PR:		274499
dd10dc88a7
Bernard Spil (brnrd) · 1.29.2
security/vaultwarden: Update to 1.29.2

PR:		273520
Approved by:	maintainer timeout
bf1349b101
Emmanuel Vadot (manu) · 1.29.1_1
security/vaultwarden: Make package rootdir friendly

- Use @dir with ownership instead of executing chown in postexec
  We should never chown -R the data directory at install (because it's empty)
  or when we upgrade (not needed)
- Fix the shipped configuration file, do not install it in etc/rc.conf.d, install
  it where vaultwarden will actually load it and use @sample

Differential Revision:	https://reviews.freebsd.org/D41602
4c7443125c
Mikael Urankar (mikael) · 1.29.1_1
lang/rust: Bump revisions after 1.72.0

PR:		273331
aba8da2be1
Bernard Spil (brnrd) · 1.29.1
security/vaultwarden: Update to 1.29.1

PR:		272444
Reported by:	Adrien <freebsd asdrip fr>
Approved by:	maintainer timeout
8f4e15df60
Mikael Urankar (mikael) · 1.28.1_3
lang/rust: Bump revisions after 1.71.0

PR:		272449
cdf28617b4
Mikael Urankar (mikael) · 1.28.1_2
lang/rust: Bump revisions after 1.70.0

PR:		271797
e1d1045bc7
Michael Reifenberger (mr) · 1.28.1_1
security/vaultwarden: Try to fix "failes to build with synth"

RUN_DEPENDS should depend on a file not a directory.

PR:		270974
Reported by:	Matthias Pfaller
20532b22c6
Michael Reifenberger (mr) · 1.28.1
security/vaultwarden: Update to 1.28.1

While there use Makefile.crates
This time try to use correct WEBVAULT_RUN_DEPENDS
75a60849f5
Mikael Urankar (mikael) · 1.28.0_1
lang/rust: Bump revisions after 1.69.0

PR:		270953
3db55c4e97
Antoine Brodin (antoine) · 1.28.0
security/vaultwarden: Revert "security/vaultwarden: Update to 1.28.1"

This reverts commit e10176835ff3c700a74a8145e453de6a97db0b2e.
31f9b29110
Michael Reifenberger (mr) · 1.28.1
security/vaultwarden: Update to 1.28.1

While there use Makefile.crates
e10176835f
Bernard Spil (brnrd) · 1.28.0
security/vaultwarden: Update to 1.28.0

* Split web_vault into separate port

PR:		270182
Approved by:	Maintainer timeout
bca4679da2
Yuri Victorovich (yuri) · 1.27.0_4
devel/capnproto: Update 0.10.1 → 0.10.3

Also add tests.

PR:	270533
Approved by:	felix@userspace.com.au (maintainer)
ed48bae687
Mikael Urankar (mikael) · 1.27.0_3
lang/rust: Bump revisions after 1.68.0

PR:		270080
ebf29acc6c
Mikael Urankar (mikael) · 1.27.0_2
lang/rust: Bump revisions after 1.67.1

PR:		269336
109e35fd59
Daniel Engberg (diizzy) · 1.27.0_1
*/*: Bump rust (cargo) ports to reflect on WITH_LTO

Bump ports in tree so they get rebuilt with new default settings
for cargo ports
12f1c627d4
Michael Reifenberger (mr) · 1.27.0
security/vaultwarden: Update to 1.27.0

This will fix the bug with web vault updated to 2022.12.0.

PR:		268599
Reported by:	Adrien
9ed2950bc2
Michael Reifenberger (mr) · 1.26.0_4
security/vaultwarden: Drop RUSTC_BOOTSTRAP

Try the build without RUSTC_BOOTSTRAP

PR:		258368
Reported by:	Jan Beich
0411212e76
Michael Reifenberger (mr) · 1.26.0_4
security/vaultwarden: update web vault to v2022.12.0

PR:		268483
Reported by:	Ralf van der Enden
8a7ddc6de9
Mikael Urankar (mikael) · 1.26.0_3
lang/rust: Bump revisions after 1.66.0

PR:		268415
ba14e01a52
Mikael Urankar (mikael) · 1.26.0_2
lang/rust: Bump revisions after 1.65.0

PR:		267622
9bf6a99963
Mikael Urankar (mikael) · 1.26.0_1
lang/rust: Bump revisions after 1.64.0

PR:		267173
afe651cf62
Michael Reifenberger (mr) · 1.26.0
security/vaultwarden: Update

Update to 1.26.0 and web vault to 2022.10.0

PR:		266517
Reported by:	Adrien <freebsd@asdrip.fr>
9aa11e5627
Stefan Eßer (se) · 1.25.2_1
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 1.25.2_1
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Baptiste Daroussin (bapt) · 1.25.2_1
rust: bring back update to 1.63

Revert back the revert of the update of rust and related commits

This revert was drive by beside validation by portmgr via exp-run
and not respectful of the etiquette we have between committers

This reverts commit 8ecb1f8141144c1603eb4026122d2e60eeaccd64.
This reverts commit 04d257baa182926cff158f32cf459e560426add0.
This reverts commit 2757c63bd0e6d01f9f0657fe03bb3a7b49adcae2.
This reverts commit 75f4713de5e3fbd1c6a0cb572e08121814a4072e.
This reverts commit e88e592111c86fdd1c0ac8717dbef9342e15e27c.
This reverts commit 783c056d7d681d66e2c5c59251c275d65274028e.

With hat:	portmgr
b9b250f912
Piotr Kubaj (pkubaj) · 1.25.2
Revert "lang/rust: Bump revisions after 1.63.0"

This reverts commit c7912d97754bb7aa9a18eb33df53f91cba4cd82d.

PR:	265915
783c056d7d
Mikael Urankar (mikael) · 1.25.2_1
lang/rust: Bump revisions after 1.63.0
c7912d9775
Michael Reifenberger (mr) · 1.25.2
security/vaultwarden: Minor update

Update to 1.25.2

PR:		265497
Reported by:	 Adrien
9c1887b863
Michael Reifenberger (mr) · 1.25.1
security/vaultwarden: Update

Update to 1.25.1 & web vault to v2022.6.2
Add simplification from brnrd@

PR:		265288
Reported by:	 Ralf van der Enden
ceb328b320