# CVE-2026-43638: Bitwarden Server missing authorization in organization cipher import

Source: https://junglewise.ai/threats/cve-2026-43638-bitwarden-server-missing-authorization-in-organization-cipher  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-43638 · Severity: medium · CVSS 5.4 · Published 2026-05-11

Bitwarden Server, the backend for the Bitwarden password management service, contained a security flaw in how it handles organization data imports. An authenticated user could bypass permission checks to inject unauthorized vault items (ciphers) into any organization's vault. This could lead to unauthorized data modification or the insertion of malicious entries into a corporate or shared password vault.

## Quick answers

**Is CVE-2026-43638 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43638 being exploited in the wild.

**How severe is CVE-2026-43638?** Medium severity, with a CVSS score of 5.4, published 11 May 2026.

**Which products and versions are affected?** Bitwarden Server < v2026.4.1.

**Is there a fix for CVE-2026-43638?** A patch was published on 2026-04-08: Fix merged into main branch via PR #7394 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43638 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-43638?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability exists in Bitwarden Server's organization import functionality. The root cause is located in the `POST /ciphers/import-organization` endpoint, where submitting an empty `collections` array causes the server-side permission check (`CheckOrgImportPermission`) to be skipped. An attacker with any valid authenticated account can exploit this to inject ciphers (vault items) into organizations they do not belong to. This bypasses intended access controls that should restrict imports to users with 'CanCreate Collections' or 'AccessToImportExport' privileges. The issue is fixed in version 2026.4.1 by implementing more robust validation in the import logic.

## Affected products

- Bitwarden Server < v2026.4.1

## Timeline

- 2026-04-08: patched: Fix merged into main branch via PR #7394
- 2026-05-05: advisory: Release v2026.4.1 published
- 2026-05-11: disclosed: CVE-2026-43638 published to NVD

## References

- [https://github.com/bitwarden/server/commit/ebbf6dd0fa752114c09d73abb48ce32a50476758](https://github.com/bitwarden/server/commit/ebbf6dd0fa752114c09d73abb48ce32a50476758)
- [https://github.com/bitwarden/server/pull/7394](https://github.com/bitwarden/server/pull/7394)
- [https://github.com/bitwarden/server/releases/tag/v2026.4.1](https://github.com/bitwarden/server/releases/tag/v2026.4.1)
- [https://sanjokkarki.com.np/blog/bitwarden-import-org-bypass](https://sanjokkarki.com.np/blog/bitwarden-import-org-bypass)
- [https://www.vulncheck.com/advisories/bitwarden-server-missing-authorization-via-organization-cipher-import](https://www.vulncheck.com/advisories/bitwarden-server-missing-authorization-via-organization-cipher-import)