CVE-2026-43639

HIGH EPSS 44.0%
Published May 11, 20261mo ago · Modified Jun 17, 20261w ago
8.9 CVSS 4.0
High
Find Similar
Published May 11, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).

CVSS Details

Base Score
8.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required High
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
44.0% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

Affected Products 1

VendorProductVersionRange
bitwardenserver* <2026.4.0

References 5

  • github.com https://github.com/bitwarden/server/commit/0918bfdda6f5eec391c69bd9074f6aef4eac0b1d
    Patch
  • github.com https://github.com/bitwarden/server/pull/7372
    Issue TrackingPatch
  • github.com https://github.com/bitwarden/server/releases/tag/v2026.4.0
    Release Notes
  • sanjokkarki.com.np https://sanjokkarki.com.np/blog/bitwarden-provider-takeover
    ExploitThird Party Advisory
  • vulncheck.com https://www.vulncheck.com/advisories/bitwarden-server-missing-authorization-via-provider-clients
    Third Party Advisory

Remediation

  • github.com https://github.com/bitwarden/server/commit/0918bfdda6f5eec391c69bd9074f6aef4eac0b1d
    Patch
  • github.com https://github.com/bitwarden/server/pull/7372
    Issue TrackingPatch