CVE-2026-43639: Missing Authorization

Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via POST /providers/providerId/clients/existing, resulting in takeover of the target organization; self-hosted installations ar...

CVE-2023-3288 A BOLA vulnerability in POST /providers in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user provider in the system. This results in privilege escalation...

CVE-2023-3288 A BOLA vulnerability in POST /providers in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user provider in the system. This results in privilege escalation...

CVE-2023-3288: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user provider in the system. This results in privilege escalation...

PT-2024-12356

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A BOLA vulnerability in the "POST /providers" endpoint allows a low-privileged user to create a privileged user provider in the system, resulting in...