Skip to content
OpenAdvisories

Vendor

bitwarden

11 known vulnerabilities.

Products

server 9 Bitwarden CLI 1 bitwarden server 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-119414

    Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create

    Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId i…

    bitwarden server
  • Medium 5.8
    CVE-2026-71959

    Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect

    Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.

    bitwarden server
  • Medium 4.3
    CVE-2026-57521

    Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController

    Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without members…

    bitwarden server
  • Medium 5.4
    CVE-2026-43638

    Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import

    Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via `POST /ciphers/import-organization` by submitting an empty `collections` array, which cau…

    bitwarden server