Threats tagged 'ghsa-vvm4-hc77-cqmc'

Bitwarden Server versions prior to v2026.4.1 have a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization by submitting an empty collections array to the POST /ciphers/import-organization endpoint. This causes the server-side permission check to be bypassed.