CVE-2026-43639
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via POST /providers/{providerId}/clients/existing, resulting in takeover of the target organization. Self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).
Risk Assessment
The risk involves unauthorized takeover of an organization by a provider service user, potentially leading to loss of control over the organization's data and resources in the Bitwarden cloud.
Recommendation
It is recommended to immediately upgrade Bitwarden Server to version v2026.4.0 or later, which fixes this vulnerability. No additional action is required for self-hosted installations.
Other vulnerabilities in Bitwarden Server
See all- CVE-2026-71959Medium
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.
- CVE-2026-60104High
A vulnerability in Bitwarden Server before 2026.6.0 allows a low-privileged organization member to obtain another user's vault key and access token. The attacker creates a Trusted Device Encryption authentication request bound to their own public key, and once approved by the victim, the data is readable from an unauthenticated endpoint, leading to account takeover.
- CVE-2026-57522Low
Bitwarden Server before 2026.5.0 has a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(). An authenticated organization member can set their display name to JSON metacharacters, injecting arbitrary key-value pairs into JSON payloads sent to configured event integrations (webhook, SIEM, Slack, Teams, Datadog).
- CVE-2026-57521Medium
A broken access control vulnerability in Bitwarden Server before 2026.5.0 allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints. The missing ManageOrganizationBillingRequirement enables attackers to retrieve Stripe-computed tax totals, subscription status, and billing details.
- CVE-2026-57520High
A privilege escalation vulnerability in Bitwarden Server before 2026.5.0 allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint.
- CVE-2026-43640High
A vulnerability in Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key. This allows an authenticated user with SCIM management privileges to obtain the key using only a valid session.
- CVE-2026-43638Medium
Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via POST /ciphers/import-organization by submitting an empty collections array, which causes the server-side permission check to be skipped.
Original NVD description (English source)
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).