Vulnerability · Published May 11, 2026 · Assigned by VulnCheck

CVE-2026-43639Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients

High 8.0

In plain English

A high-severity missing authorization in server from bitwarden. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.6%top 51.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).

Affected products (as reported)

Vendor	Product	Versions
bitwarden	server	0 – before 2026.4.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://sanjokkarki.com.np/blog/bitwarden-provider-takeover technical-description, exploit
https://github.com/bitwarden/server/releases/tag/v2026.4.0 release-notes
https://github.com/bitwarden/server/pull/7372 issue-tracking
https://github.com/bitwarden/server/commit/0918bfdda6f5eec391c69bd9074f6aef4eac0b1d patch
https://www.vulncheck.com/advisories/bitwarden-server-missing-authorization-via-provider-clients third-party-advisory