Bitwarden Server versions prior to 2026.4.0 contain a missing authorization flaw that allows a provider service user to call the endpoint POST /providers/{providerId}/clients/existing and add any organization to the provider. The vulnerability is a classic example of CWE‑862 – missing access control. The execution of this exploit gives the attacker the ability to assume control of the chosen organization, gaining unrestricted access to that organization's vault data, policies, and member accounts.

The affected product is Bitwarden Server with all releases before 2026.4.0. Self‑hosted instances are not impacted because the vulnerable endpoint is exposed only to the Cloud deployment (SelfHosted(NotSelfHostedOnly = true)).

The CVSS score of 8.9 classifies this issue as high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of protection on a central server endpoint means a provider who already has an authenticated session could read or manipulate any organization’s data. The exploit requires an attacker to possess valid credentials for a provider account and to know the target organization’s identifier, making it a moderate-to-high risk scenario for organizations relying on the provider model.