Skip to content
Threat Feed

Tag

Bitwarden

1 brief RSS
high advisory

Bitwarden Server Missing Authorization Vulnerability Leading to Organization Takeover (CVE-2026-43639)

Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability (CVE-2026-43639) that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization in cloud-hosted deployments.

Bitwarden Server cve bitwarden takeover missing-authorization cloud
2r 1t 1c