CVE-2026-43638: Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import
Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via POST /ciphers/import-organization by submitting an empty collections array, which causes the server-side permission check to be skipped.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43638?
CVE-2026-43638 is considered a medium-severity vulnerability due to its potential impact on organizational data integrity.
How do I fix CVE-2026-43638?
To fix CVE-2026-43638, upgrade your Bitwarden Server to version 2026.4.1 or later.
What is the impact of CVE-2026-43638?
CVE-2026-43638 allows authenticated users to import ciphers into any organization, which could lead to unauthorized access to sensitive information.
Is my version of Bitwarden affected by CVE-2026-43638?
Any version of Bitwarden Server prior to 2026.4.1 is affected by CVE-2026-43638.
How does CVE-2026-43638 work?
CVE-2026-43638 exploits a missing authorization check in the `POST /ciphers/import-organization` endpoint, allowing users to bypass restrictions.