Bitwarden Server before version 2026.4.0 contains a missing authorization vulnerability in the endpoint POST /providers/{providerId}/clients/existing. This flaw permits a provider service user to add any organization to their provider, which can result in the takeover of the targeted organization. The vulnerability is limited to the cloud-hosted service since the endpoint is restricted from self-hosted deployments. The CVSS 4.0 score is 8.9, indicating a high severity issue. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

Exploitation of this vulnerability could allow an authorized provider service user to add arbitrary organizations to their provider, leading to unauthorized control or takeover of those organizations within the Bitwarden cloud environment. Self-hosted Bitwarden Server instances are not affected. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this vulnerability affects only the cloud-hosted Bitwarden Server and self-hosted installations are unaffected, users of the cloud service should monitor official Bitwarden communications for updates. No official fix or workaround is currently documented.