Sanjok Karki

**Name of the Vulnerable Software and Affected Versions** Bitwarden Server versions prior to 2026.7.2 **Description** An issue exists where the server fails to verify if the caller is a member of the organization specified in the request body of the 'POST /collect' endpoint. This allows any authenticated user to inject forged entries with arbitrary backdates into the audit log of any organization. **Recommendations** Update Bitwarden Server to version 2026.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** Bitwarden Server versions prior to 2026.6.0 **Description** An issue exists where the server fails to verify if the email address provided in the body of the 'POST /auth-requests/admin-request' endpoint belongs to the authenticated user. This allows a low-privileged organization member to initiate a Trusted Device Encryption authentication request bound to a public key controlled by the attacker. Once approved, the request becomes readable from an unauthenticated endpoint, enabling the attacker to obtain another user's vault key and a victim-scoped access token, leading to account takeover and disclosure of the vault key. **Recommendations** Update Bitwarden Server to version 2026.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Bitwarden Server versions prior to 2026.5.0 **Description** An issue exists where authenticated Custom users with the `ManageUsers` permission can escalate privileges to remove Admin accounts from an organization. This occurs due to a missing role hierarchy check in the bulk user-remove endpoint. By supplying Admin organization-user IDs in a bulk DELETE request, an attacker can bypass the security guards present in the single-user removal path. **Recommendations** Update Bitwarden Server to version 2026.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** Bitwarden Server versions prior to 2026.5.0 **Description** Broken access control allows any authenticated user to access arbitrary organization billing data. By supplying an arbitrary `organizationId` to the `PreviewInvoiceController` endpoints, an attacker can bypass membership and authorization checks due to a missing `ManageOrganizationBillingRequirement`. This allows the retrieval of subscription status, Stripe-computed tax totals, and billing details derived from a target organization's customer and subscription data. **Recommendations** Update Bitwarden Server to version 2026.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** Bitwarden Server versions prior to 2026.5.0 **Description** An issue exists in the `IntegrationTemplateProcessor.ReplaceTokens()` function where user-controlled values are substituted into event-integration templates without proper JSON encoding. An authenticated member can exploit this by setting their display name to include JSON metacharacters. This allows the injection of arbitrary key-value pairs into rendered payloads sent to webhook, SIEM, Slack, Teams, or Datadog endpoints. The injected fields are indistinguishable from legitimate template output when tokens such as `#ActingUserName#` or `#UserName#` are used. **Recommendations** Update Bitwarden Server to version 2026.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** Bitwarden Server versions prior to 2026.4.0 **Description** A missing authorization issue allows a provider service user to add an arbitrary organization to their provider. This is possible through the 'POST /providers/{providerId}/clients/existing' endpoint, where the `providerId` variable is used. Successful exploitation can result in the takeover of the target organization. This issue specifically affects Cloud installations, as the endpoint is restricted and not available in self-hosted environments. **Recommendations** Update to version 2026.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** Bitwarden Server versions prior to 2026.4.1 **Description** A missing authorization issue allows any authenticated user to write ciphers into an arbitrary organization. This occurs when submitting an empty `collections` array to the 'POST /ciphers/import-organization' endpoint, which causes the server-side permission check to be skipped. **Recommendations** Update to version 2026.4.1 or later. Avoid using the `collections` parameter with an empty array in the 'POST /ciphers/import-organization' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Bitwarden Server versions prior to 2026.4.1 **Description** An issue exists where master-password re-authentication is not required when retrieving or rotating an organization's SCIM API key. This allows an authenticated user with SCIM management privileges to obtain the key using only a valid session. **Recommendations** Update to version 2026.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-615 version 20.06 **Description** The issue allows unauthorized access to the WAN configuration page "wan.htm" without authentication, potentially disclosing WAN settings information and enabling attackers to modify data fields on the page. **Recommendations** For version 20.06, consider restricting access to the "wan.htm" page until a patch is available. As a temporary workaround, limit access to the device's configuration interface to minimize the risk of exploitation.