Bitwarden Server 2026.7.2 Release Notes: Backend Endpoint Unauthorized Access Fix

Vulnerability Overview The webpage screenshot displays the release notes for Bitwarden Server version 2026.7.2, which contains multiple security-related fixes and improvements. The primary vulnerabilities addressed are as follows: 1. Plan Change Tax Preview in Secrets Manager and Storage: - Fixed issues related to plan change tax preview in Secrets Manager and storage. 2. Availability of Organization Invitation Links: - Fixed the issue where the status of organization invitation links could not be retrieved when unavailable. 3. Access to the Admin Org Page After Stripe Customer Deletion: - Fixed the issue where the Admin Org page became inaccessible after a Stripe customer was deleted. 4. Fix for Restoring Phased Users: - Fixed issues related to restoring phased users. 5. Backend Endpoint Protection: - Enhanced protection for backend endpoints to prevent non-registered members from accessing endpoints and viewing data. 6. Secret Access Checks in SecretVersionsController: - Strengthened secret access checks within the SecretVersionsController. 7. Enhancements to PreviewOrganizationTaxCommand: - Enhanced PreviewOrganizationTaxCommand to support Teams Starter 2023. 8. Feature Flag for Derived SSH Keys: - Added a feature flag for derived SSH keys. 9. Provider Seat Limit Validation Messages: - Enhanced validation messages for provider seat limits. Impact Scope The fixes for these vulnerabilities affect multiple aspects of Bitwarden Server, including: Secrets Manager: Ensures that the plan change tax preview functionality in Secrets Manager and storage operates correctly. Organization Invitation Links: Ensures that the status of organization invitation links is correctly retrieved when they are unavailable. Admin Org Page: Ensures that the Admin Org page remains accessible after a Stripe customer is deleted. Phased User Restoration: Ensures that phased users can be restored correctly. Backend Endpoint Protection: Prevents non-registered members from accessing sensitive endpoints and viewing data. SecretVersionsController: Enhances secret access checks to prevent unauthorized access. PreviewOrganizationTaxCommand: Supports tax previews for Teams Starter 2023. Derived SSH Keys: Provides functionality for derived SSH keys. Provider Seat Limits: Enhances seat limit validation messages to ensure users are informed about limitations. Remediation The specific remediation measures include: 1. Plan Change Tax Preview in Secrets Manager and Storage: - Fixed issues related to plan change tax preview in Secrets Manager and storage. 2. Availability of Organization Invitation Links: - Fixed the issue where the status of organization invitation links could not be retrieved when unavailable. 3. Access to the Admin Org Page After Stripe Customer Deletion: - Fixed the issue where the Admin Org page became inaccessible after a Stripe customer was deleted. 4. Fix for Restoring Phased Users: - Fixed issues related to restoring phased users. 5. Backend Endpoint Protection: - Enhanced protection for backend endpoints to prevent non-registered members from accessing endpoints and viewing data. 6. Secret Access Checks in SecretVersionsController: - Strengthened secret access checks within the SecretVersionsController. 7. Enhancements to PreviewOrganizationTaxCommand: - Enhanced PreviewOrganizationTaxCommand to support Teams Starter 2023. 8. Feature Flag for Derived SSH Keys: - Added a feature flag for derived SSH keys. 9. Provider Seat Limit Validation Messages: - Enhanced validation messages for provider seat limits. Proof of Concept (POC) Code or Exploit Code No specific POC code or exploit code was included in the page. Summary The release notes for Bitwarden Server version 2026.7.2 contain multiple security-related fixes and improvements, primarily involving Secrets Manager, organization invitation links, the Admin Org page, phased user restoration, backend endpoint protection, SecretVersionsController, PreviewOrganizationTaxCommand, derived SSH keys, and provider seat limits. These fixes enhance the system's security and stability, mitigating potential security vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Bitwarden Server 2026.7.2 Release Notes: Backend Endpoint Unauthorized Access Fix

More from this source