CVE-2026-43639: Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via POST /providers/{providerId}/clients/existing, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitwarden serverto a version that resolves this vulnerability.Fixed in 2026.4.0 - Compensating control
Ensure the endpoint POST /providers/{providerId}/clients/existing is restricted to Bitwarden Cloud only (self-hosted unaffected as the endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true)).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43639?
CVE-2026-43639 is classified as a high severity vulnerability due to its potential to allow unauthorized organization creation.
How do I fix CVE-2026-43639?
To fix CVE-2026-43639, upgrade your Bitwarden Server to version 2026.4.0 or later.
What is the impact of CVE-2026-43639?
CVE-2026-43639 can allow malicious users to gain unauthorized access and manage arbitrary organizations within the Bitwarden environment.
Who is affected by CVE-2026-43639?
Only users operating Bitwarden Server versions prior to 2026.4.0 are affected by CVE-2026-43639.
Is there a workaround for CVE-2026-43639 before upgrading?
There is currently no official workaround for CVE-2026-43639, and upgrading is the recommended solution.