EUVD-2026-29130

🗓️ 11 May 2026 18:31:46Reported by EUVDType

Bitwarden server before 2026.4.1 allows any authenticated user to write ciphers to any organization via importing with an empty collections array, skipping permission checks.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-43638	11 May 202617:13	–	attackerkb
CNNVD	bitwarden 安全漏洞	11 May 202600:00	–	cnnvd
CVE	CVE-2026-43638	11 May 202617:13	–	cve
Cvelist	CVE-2026-43638 Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import	11 May 202617:13	–	cvelist
NVD	CVE-2026-43638	11 May 202618:16	–	nvd
Positive Technologies	PT-2026-39662	11 May 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-43638 Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import	11 May 202617:13	–	vulnrichment

[
  {
    "enisaIdVendor": [
      {
        "id": "6dc21775-c9c7-32ca-bf06-92312d9044d6",
        "vendor": {
          "name": "Bitwarden"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "39b12305-4947-3b41-8f81-da11c05cb0b5",
        "product": {
          "name": "Server"
        },
        "product_version": "0 <2026.4.1"
      }
    ]
  }
]

Source	Link
sanjokkarki	www.sanjokkarki.com.np/blog/bitwarden-import-org-bypass
github	www.github.com/bitwarden/server/releases/tag/v2026.4.1
github	www.github.com/bitwarden/server/pull/7394
github	www.github.com/bitwarden/server/commit/ebbf6dd0fa752114c09d73abb48ce32a50476758
vulncheck	www.vulncheck.com/advisories/bitwarden-server-missing-authorization-via-organization-cipher-import
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-43638

11 May 2026 18:31Current

5.9Medium risk

Vulners AI Score5.9

CVSS 45.3

CVSS 3.15.4

EPSS0.00188

SSVC