CVE-2026-43638 is a missing authorization vulnerability in Bitwarden Server before version 2026.4.1. It arises when an authenticated user submits a `POST` request to the `/ciphers/import-organization` endpoint with an empty `collections` array. This input causes the server-side permission check to be bypassed, allowing the user to write cipher data into any organization without proper authorization. The vulnerability is rated medium severity with a CVSS 4.0 base score of 5.3, indicating moderate impact and ease of exploitation with low attack complexity and no user interaction required.

An authenticated user can bypass authorization controls to write cipher data into arbitrary organizations, potentially leading to unauthorized modification of sensitive encrypted data within the Bitwarden Server. This could compromise the integrity of organizational secrets stored in the vault. However, exploitation requires authentication, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user permissions carefully and monitor for unusual activity related to the `/ciphers/import-organization` endpoint. Avoid submitting requests with empty `collections` arrays if possible. Follow vendor updates closely for an official patch or temporary mitigation.