CVE-2026-43640

概要

参考情報

• bitwarden/server commit eb251d9 · Patch
• bitwarden/server#7403 · Issue Tracking
• bitwarden/server release v2026.4.1 · Release Notes
• sanjokkarki.com.np/blog/bitwarden-scim-key-bypass · Exploit
• vulncheck.com/advisories/bitwarden-server-authentication-bypass-via-scim-api-key · Third Party Advisory

server のその他の脆弱性

• CVE-2026-60104高 8.0Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated cal…
• CVE-2026-57522中 5.0Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes …
• CVE-2026-57521中 4.3Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organ…
• CVE-2026-57520高 7.1Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permi…
• CVE-2026-43639緊急 9.1Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary o…