PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43638 Bitwarden CVE debrief

CVE-2026-43638 is a missing authorization vulnerability in Bitwarden Server prior to v2026.4.1. An authenticated user can write ciphers into an arbitrary organization via `POST /ciphers/import-organization` by submitting an empty `collections` array, which causes the server-side permission check to be skipped. This vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. The vulnerability was patched in v2026.4.1. Bitwarden Server administrators and users who rely on the server for secure data storage and management should be aware of this vulnerability and take immediate action to update to v2026.4.1 or later.

Vendor
Bitwarden
Product
Server
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-11
Original CVE updated
2026-07-14
Advisory published
2026-05-11
Advisory updated
2026-07-14

Who should care

Bitwarden Server administrators and users who rely on the server for secure data storage and management should be aware of this vulnerability and take immediate action to update to v2026.4.1 or later. This includes reviewing and monitoring user activity for suspicious behavior and implementing additional security controls to prevent unauthorized access.

Technical summary

The vulnerability exists in the `POST /ciphers/import-organization` endpoint, where an authenticated user can bypass authorization checks by submitting an empty `collections` array. This allows the user to write ciphers into an arbitrary organization. The issue was patched in v2026.4.1. The CVSS score for this vulnerability is 5.3, indicating a moderate severity. The vulnerability affects Bitwarden Server prior to v2026.4.1.

Defensive priority

High

Recommended defensive actions

  • Update Bitwarden Server to v2026.4.1 or later
  • Review and monitor user activity for suspicious behavior
  • Implement additional security controls to prevent unauthorized access
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-05-11T18:16:36.823Z and was last modified on 2026-07-14T21:16:54.040Z. The NVD entry is currently Analyzed. There is limited information available about the specific impact of this vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability exists in Bitwarden Server prior to v2026.4.1, and an authenticated user can write ciphers into an arbitrary organization via `POST /ciphers/import-organization` by submitting an empty `collections` array.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-05-11T18:16:36.823Z and has not been modified since then. The NVD entry is currently Analyzed.