Bitwarden Server versions earlier than 2026.4.1 contain a missing authorization check that allows any authenticated user to write cipher data into an arbitrary organization by calling POST /ciphers/import-organization with an empty collections array. The flaw is a classic authorization bypass (CWE‑862) that lets users perform actions outside their granted permissions without triggering the usual server‑side permission validation.

The vulnerability affects the Bitwarden Server product. Any installation running a version older than 2026.4.1 is potentially exposed. The failing endpoint is the organization‑level cipher import route used for bulk imports of cipher data into organizational vaults.

The CVSS score is 5.3, indicating moderate severity. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalogue. Exploitation requires only an authenticated user account; no elevated privileges or network exposure are needed. An attacker can inject arbitrary cipher records into organisations they do not own, potentially enabling data leakage or privilege escalation within those organisations.