Threats tagged 'ghsa-79fq-fw2p-vq3j'

Bitwarden Server versions prior to v2026.4.0 contain a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via a specific API endpoint. This vulnerability can lead to takeover of the target organization. Self-hosted installations are not affected because the vulnerable endpoint is restricted to cloud deployments.