CVE-2026-43639 Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients
A provider user can add arbitrary organizations to their provider, leading to organization takeover in cloud deployments.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-43639?
CVE-2026-43639 is a high-severity missing authorization vulnerability in bitwarden server, published on 11 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).
Weakness: CWE-862
Which versions are affected by CVE-2026-43639?
It affects 1 product.
Products include Bitwarden Server.
How do I fix CVE-2026-43639?
No fix has been published for CVE-2026-43639 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-43639 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43639 exists.
Other vulnerabilities in bitwarden server
- CVE-2026-60104 Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request
- CVE-2026-43640 Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key
- CVE-2020-15879 Server-side request forgery in n/a
- CVE-2019-19766 Weak cryptography in n/a
- CVE-2026-57520 Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint
Sources
Also known as GHSA-79fq-fw2p-vq3j.