CVE-2026-43640
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A vulnerability in Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key. This allows an authenticated user with SCIM management privileges to obtain the key using only a valid session.
Risk Assessment
The risk is that an attacker with session access can compromise the SCIM API key, potentially leading to unauthorized access to identity management functions and possible user account compromise.
Recommendation
Immediately upgrade Bitwarden Server to version v2026.4.1 or later, which enforces master-password re-authentication when accessing the SCIM API key.
Other vulnerabilities in Bitwarden Server
See all- CVE-2026-71959Medium
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.
- CVE-2026-60104High
A vulnerability in Bitwarden Server before 2026.6.0 allows a low-privileged organization member to obtain another user's vault key and access token. The attacker creates a Trusted Device Encryption authentication request bound to their own public key, and once approved by the victim, the data is readable from an unauthenticated endpoint, leading to account takeover.
- CVE-2026-57522Low
Bitwarden Server before 2026.5.0 has a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(). An authenticated organization member can set their display name to JSON metacharacters, injecting arbitrary key-value pairs into JSON payloads sent to configured event integrations (webhook, SIEM, Slack, Teams, Datadog).
- CVE-2026-57521Medium
A broken access control vulnerability in Bitwarden Server before 2026.5.0 allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints. The missing ManageOrganizationBillingRequirement enables attackers to retrieve Stripe-computed tax totals, subscription status, and billing details.
- CVE-2026-57520High
A privilege escalation vulnerability in Bitwarden Server before 2026.5.0 allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint.
- CVE-2026-43639High
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via POST /providers/{providerId}/clients/existing, resulting in takeover of the target organization. Self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).
- CVE-2026-43638Medium
Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via POST /ciphers/import-organization by submitting an empty collections array, which causes the server-side permission check to be skipped.
Original NVD description (English source)
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.