CVE-2026-43639 is a missing authorization flaw (CVSS 8.0, high) in Bitwarden Server before v2026.4.0. A provider service user could add an arbitrary organization to their provider and take it over. The record says self-hosted installations are unaffected, because the endpoint is limited to Cloud.
What's affected
The record names Bitwarden Server before v2026.4.0, and the release tag v2026.4.0 is among its references. The vulnerable endpoint is POST /providers/providerId/clients/existing, and it is restricted to Cloud by a not self hosted setting. Self-hosted installations are therefore unaffected according to the record.
Bitwarden operates the Cloud service, so the work for customers is mostly to check Bitwarden's own notices and review provider relationships. I did not retrieve the release page.
How to check if you're exposed
If you self-host, the record says you are not affected, but running current server releases is still good practice. Check your version against v2026.4.0 or later.
If you use Bitwarden Cloud, review your organization's provider links. In the admin console, look for provider relationships you do not recognise and for organizations added to providers recently. Also ask the people who hold provider service roles in your company whether any are shared or loosely controlled.
What to do now
- Self-hosted: run v2026.4.0 or later as a matter of routine.
- Cloud customers: review the providers linked to your organizations and remove any you do not know.
- Limit who holds provider service user roles and enable two-step login for them.
- Check Bitwarden release notes and advisories for the date the fix reached Cloud.
- If a link looks wrong, contact Bitwarden support at once.
Why it matters
The weakness is CWE-862, missing authorization. The endpoint checked that the caller was a provider service user, but not that they were allowed to attach the target organization. A person with a high privilege role in one place could reach into another.
The attack complexity and the need for a privileged role limit who can try it, yet the effect is a full takeover of the target organization, which is why impact scores are high. The KEV flag is false.
Quick check
Do self-hosters need to do anything?
The record says self-hosted installations are unaffected. Keeping the server current is still wise.
Sources
- Bitwarden server release v2026.4.0 (listed in the NVD record, not retrieved)
- Fix pull request 7372 (listed in the NVD record, not retrieved)
- Gold page for this CVE
Last reviewed: 19 October 2026.
