CVE-2026-43638
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via POST /ciphers/import-organization by submitting an empty collections array, which causes the server-side permission check to be skipped.
Risk Assessment
The risk is that an unauthorized user can add their own ciphers to any organization, potentially injecting malicious data or compromising the integrity of stored passwords.
Recommendation
It is recommended to immediately upgrade Bitwarden Server to version v2026.4.1 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via `POST /ciphers/import-organization` by submitting an empty `collections` array, which causes the server-side permission check to be skipped.