Which versions of Bitwarden Server are affected by CVE-2026-43639?

Bitwarden Server Cloud contains a critical authorization flaw allowing authenticated provider users to seize control of any organization without victim consent, enabling complete administrative…. A patch is available.

Is there a public PoC exploit available for CVE-2026-43639?

Yes, a public proof-of-concept exploit is available for CVE-2026-43639. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-43639?

Within 24 hours: Identify all Bitwarden Cloud provider service users and audit recent API activity to the POST /providers/{providerId}/clients/existing endpoint for unauthorized organization additions. Within 7 days: Apply vendor-released patch v2026.4.0 to all Bitwarden Server Cloud instances and rotate administrative credentials for affected organizations. Within 30 days: Conduct full access review of provider-managed organizations, reset API keys for provider service accounts, and implement network segmentation to restrict provider endpoint access.

Bitwarden Server CVE-2026-43639

Q: What is the CVSS score of CVE-2026-43639?

CVE-2026-43639 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29170 HIGH

Missing Authorization (CWE-862)

2026-05-11 VulnCheck

GHSA-79fq-fw2p-vq3j

Authentication Bypass Server

8.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 11, 2026 - 18:45 vuln.today

Analysis Generated

May 11, 2026 - 18:45 vuln.today

CVSS changed

May 11, 2026 - 18:22 NVD

8.0 (HIGH) 8.9 (HIGH)

CVE Published

May 11, 2026 - 17:14 nvd

HIGH 8.9

DescriptionCVE.org

Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via POST /providers/{providerId}/clients/existing, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).

AnalysisAI

Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access, achieving complete administrative takeover. The vulnerability exploits a missing authorization check in the POST /providers/{providerId}/clients/existing endpoint, allowing authenticated provider users to add any organization to their provider without the target's consent. Publicly available exploit code exists (detailed writeup by Sanjok Karki), and vendor-released patch v2026.4.0 fully addresses the issue via GitHub PR #7372. Self-hosted installations are unaffected due to endpoint access restrictions. CVSS 8.9 reflects high confidentiality, integrity, and availability impact with high attack complexity and high privilege requirements.

Technical ContextAI

The vulnerability stems from a missing authorization check (CWE-862) in Bitwarden Server's provider management API endpoint. Bitwarden uses a provider-client model where Managed Service Providers (MSPs) manage multiple customer organizations. The vulnerable endpoint POST /providers/{providerId}/clients/existing was designed to add existing organizations to a provider's management scope, but failed to verify whether the authenticated provider service user had legitimate authority over the target organization. This authorization gap is particularly critical in multi-tenant SaaS environments where tenant isolation is paramount. The endpoint includes a SelfHosted(NotSelfHostedOnly = true) attribute, restricting this functionality to Bitwarden's Cloud platform only, which explains why self-hosted deployments are unaffected. The fix in commit 0918bfdda6f implements proper authorization validation before allowing organization-provider association.

RemediationAI

Upgrade Bitwarden Server Cloud to version 2026.4.0 immediately, which implements authorization validation via GitHub PR #7372 (commit 0918bfdda6f). For Bitwarden Cloud customers, the vendor likely applies this patch to their hosted infrastructure automatically, but administrators should verify their instance version through the admin console and confirm upgrade completion with Bitwarden support if uncertainty exists. Self-hosted installations require no action as the vulnerable endpoint is disabled in these deployments. As interim compensating controls while awaiting patch deployment, organizations using provider features should audit all provider-client associations via the admin console to detect unauthorized organization additions, revoke provider service user access for accounts not requiring MSP management capabilities (reducing attack surface), enable comprehensive audit logging for provider API operations to detect exploitation attempts, and implement anomalous API activity monitoring specifically for POST requests to /providers/*/clients/* endpoints. These mitigations reduce but do not eliminate risk since detection is reactive rather than preventive. Full remediation requires upgrading to v2026.4.0. Review GitHub release notes for any deployment considerations: https://github.com/bitwarden/server/releases/tag/v2026.4.0.