CVE-2026-43638

Name of the Vulnerable Software and Affected Versions Bitwarden Server versions prior to 2026.4.1

Description A missing authorization issue allows any authenticated user to write ciphers into an arbitrary organization. This occurs when submitting an empty collections array to the 'POST /ciphers/import-organization' endpoint, which causes the server-side permission check to be skipped.

Recommendations Update to version 2026.4.1 or later. Avoid using the collections parameter with an empty array in the 'POST /ciphers/import-organization' endpoint until the update is applied.