bitwarden server up to 2026.4.0 existing authorization

Summaryinfo

A vulnerability, which was classified as problematic, was found in bitwarden server up to 2026.4.0. Affected by this vulnerability is an unknown functionality of the file /providers/{providerId}/clients/existing. Such manipulation leads to authorization. This vulnerability is traded as CVE-2026-43639. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in bitwarden server up to 2026.4.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /providers/{providerId}/clients/existing. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).

The weakness was shared by Sanjok Karki. The advisory is available at sanjokkarki.com.np. This vulnerability is handled as CVE-2026-43639 since 05/01/2026. The exploitation is known to be difficult. The attack may be launched remotely. Additional levels of successful authentication are needed for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 2026.4.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 0918bfdda6f5eec391c69bd9074f6aef4eac0b1d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• bitwarden

Name

• server

Version

• 2026.0
• 2026.1
• 2026.2
• 2026.3
• 2026.4.0

License

• open-source

Website

• Product: https://github.com/bitwarden/server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Duplicate

• Submit #XXXXXX: Xxxxxxxxx Xxxxxxxxx/xxxxxx <xxxx.x.x Xxxxxxx Xxxxxxxxxxxxx / Xxxxxx Xxxxxx Xxxxx Xxxxxxxxxxxxx (xxxx) (by thesanjok)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion