CVE-2026-43638

概要

参考情報

• bitwarden/server commit ebbf6dd · Patch
• bitwarden/server#7394 · Issue Tracking
• bitwarden/server release v2026.4.1 · Release Notes
• sanjokkarki.com.np/blog/bitwarden-import-org-bypass · Exploit
• vulncheck.com/advisories/bitwarden-server-missing-authorization-via-organization-cipher-import · Third Party Advisory

server のその他の脆弱性

• CVE-2026-60104高 8.0Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated cal…
• CVE-2026-57522中 5.0Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes …
• CVE-2026-57521中 4.3Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organ…
• CVE-2026-57520高 7.1Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permi…
• CVE-2026-43640高 8.1Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM AP…