Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: bitwarden server 2026.4.1 Clear all filters
TI-2026-31742 CVE-2026-43640 · GHSA-6736-x63f-c628

Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key

Priority HIGH 72

Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain…

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00504 Published 2026-05-11 Fixed in 2026.4.1 CWE-303
TI-2026-31740 CVE-2026-43638 · GHSA-vvm4-hc77-cqmc

Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import

Priority MEDIUM 57

Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via `POST /ciphers/import-organization` by submitting…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00188 Published 2026-05-11 Fixed in 2026.4.1 CWE-862