| Package | Affected versions | Patched versions |
|---|---|---|
| server | < 2026.4.1 | 2026.4.1 |
Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via `POST /ciphers/import-organization` by submitting an empty `collections` array, which causes the server-side permission check to be skipped.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free