| शीर्षक | Bitwarden Bitwarden/Server <2026.4.0 Missing Authorization / Broken Object Level Authorization (BOLA) |
|---|
| विवरण | Bitwarden Server before 2026.4.0 has a missing authorization vulnerability in the POST /providers/{providerId}/clients/existing endpoint (ProviderClientsController.cs). The endpoint validates that the caller is an authenticated provider member via TryGetBillableProviderForServiceUserOperation but performs no verification that the caller owns or has any relationship to the target organization supplied in the request body. An attacker with a valid provider account can supply an arbitrary organization GUID to immediately cancel the victim organization's Stripe subscription (with InvoiceNow=true), overwrite the billing email, set GatewaySubscriptionId to null, change the organization status to Managed, and create a ProviderOrganization link giving the attacker full provider admin access over the victim organization. |
|---|
| स्रोत | ⚠️ https://sanjokkarki.com.np/blog/bitwarden-provider-takeover |
|---|
| उपयोगकर्ता | thesanjok (UID 97863) |
|---|
| सबमिशन | 02/05/2026 12:26 AM (5 महीनों पहले) |
|---|
| संयम | 26/05/2026 02:44 PM (25 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 362714 [bitwarden server तक 2026.4.0 existing अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|