CVE-2026-43639
CVE-2026-43639
8.9
HighPublished:
Last updated:
Source:disclosure@vulncheck.com
Analyzed
Weakness (CWE)
CVSS Vector
v4.0- Attack Vector
- Network
- Attack Complexity
- High
- Attack Requirements
- None
- Privileges Required
- High
- User Interaction
- None
- Confidentiality (Vulnerable)
- High
- Integrity (Vulnerable)
- High
- Availability (Vulnerable)
- High
- Confidentiality (Subsequent)
- High
- Integrity (Subsequent)
- High
- Availability (Subsequent)
- High
Description
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).
References
disclosure@vulncheck.com
https://github.com/bitwarden/server/commit/0918bfdda6f5eec391c69bd9074f6aef4eac0b1ddisclosure@vulncheck.com
https://github.com/bitwarden/server/pull/7372disclosure@vulncheck.com
https://github.com/bitwarden/server/releases/tag/v2026.4.0disclosure@vulncheck.com
https://sanjokkarki.com.np/blog/bitwarden-provider-takeoverdisclosure@vulncheck.com
https://www.vulncheck.com/advisories/bitwarden-server-missing-authorization-via-provider-clients