Bitwarden Server Version 2026.6.2

Overview

• Removed feature flag for organization features caching
• Removed feature flag for member controller refactor
• Removed feature flag for collections component refactor
• Added new 'staged' status for organization members
• Invited users no longer reach dead end when attempting to log in with SSO
• Fixed cases where new device login protection email could not be re-sent
• Various under-the-hood improvements and minor bug fixes

What's Changed

:shipit: Feature Development

• [PM-34053] Add new GET endpoint for fetching key data for user key rotation by @Thomas-Avery in https://github.com/bitwarden/server/pull/7772
• [PM-38393]: add debug-disable-self-host-premium-check feature flag by @kdenney in https://github.com/bitwarden/server/pull/7805
• [PM-34779] Add accept invite link endpoint by @r-tome in https://github.com/bitwarden/server/pull/7812
• [PM-31884] Add access control support to Send Controls policy by @mcamirault in https://github.com/bitwarden/server/pull/7417
• [PM-36158] - Fix org cipher push notifications to fan out per authorized user by @jaasen-livefront in https://github.com/bitwarden/server/pull/7522
• [PM-36963] Bulk cohort assignment by @kdenney in https://github.com/bitwarden/server/pull/7792
• [PM-37513] feat: Add Enterprise 2019 to current pricing migration path by @cyprain-okeke in https://github.com/bitwarden/server/pull/7819
• [PM-34023] Remove 2FA account recovery flag by @eliykat in https://github.com/bitwarden/server/pull/7815
• [PM-39129] Add UsePam organization capability by @Hinton in https://github.com/bitwarden/server/pull/7816
• [PM-39257] Add feature flag pm-32380-btn-text-add-create by @jengstrom-bw in https://github.com/bitwarden/server/pull/7833
• [PM-32116] Remove pm-32111-provider-ability-extended-cache logic by @JimmyVo16 in https://github.com/bitwarden/server/pull/7838
• [PM-39102] Feature Flag for Staged Status by @sven-bitwarden in https://github.com/bitwarden/server/pull/7844
• Auth/PM-38742 - SSO Invited Existing User Flow Improvement - Redirect on error by @JaredSnider-Bitwarden in https://github.com/bitwarden/server/pull/7785
• [PM-36865] Removes the feature flag from the constants of the server-side code by @JaredScar in https://github.com/bitwarden/server/pull/7849
• [PM-30806] Self service change email command by @ike-kottlowski in https://github.com/bitwarden/server/pull/7740
• [PM-38851] Crypto cipher suite feature flag by @mzieniukbw in https://github.com/bitwarden/server/pull/7852
• [PM-38422] feat: Stack customer-level discount with churn and migration discounts by @amorask-bitwarden in https://github.com/bitwarden/server/pull/7831
• [PM-37512] feat: Add Teams Starter to current pricing migration path by @amorask-bitwarden in https://github.com/bitwarden/server/pull/7827
• [PM-37953] Add OrganizationUserStatusType.Staged, Remove Ordinal Checks by @sven-bitwarden in https://github.com/bitwarden/server/pull/7780
• [PM-36965] feat: Add CSV export of cohort to cohort management table by @cyprain-okeke in https://github.com/bitwarden/server/pull/7847
• [PM-32108] - Remove FF for org ability cache by @jrmccannon in https://github.com/bitwarden/server/pull/7821
• [PM-38922] - Adding Problem Details Result by @jrmccannon in https://github.com/bitwarden/server/pull/7853
• Revert "[PM-38851] Crypto cipher suite feature flag" by @mzieniukbw in https://github.com/bitwarden/server/pull/7863
• Add PM39071_DefaultPasswordManagerPrompt constant by @differsthecat in https://github.com/bitwarden/server/pull/7866
• [PM-35314] Backfill Revocation Reasons to All Users by @sven-bitwarden in https://github.com/bitwarden/server/pull/7713

Bug fixes

• [PM-38830] fix: Surface fixed-amount and time-bounded discounts in billing API by @amorask-bitwarden in https://github.com/bitwarden/server/pull/7814
• [PM-36158] - bump migration file name by @jaasen-livefront in https://github.com/bitwarden/server/pull/7820
• fix broken auto confirm policyRequirement check for org scoped request by @BTreston in https://github.com/bitwarden/server/pull/7839
• [PM-36574] fix: scope provider client invoice report to the authorized provider by @connerbw in https://github.com/bitwarden/server/pull/7770
• [PM-39237] fix: Handle mismatched and orphaned migration cohort assignments in admin dropdown by @cyprain-okeke in https://github.com/bitwarden/server/pull/7836
• [PM-38769] Fix OrganizationConnectionsController logic by @eliykat in https://github.com/bitwarden/server/pull/7845
• [PM-38456]: Allow License Generation for Sales Trial Orgs by @sbrown-livefront in https://github.com/bitwarden/server/pull/7793
• [PM-39562] fix: Reconcile org seats to billed quantity on packaged-plan migration by @amorask-bitwarden in https://github.com/bitwarden/server/pull/7869
• [PM-39569][PM-39286] fix: Wait for Stripe test clock before migration grace write by @amorask-bitwarden in https://github.com/bitwarden/server/pull/7872

Maintenance

• [PM-29129] Add Policy Update Event README by @JimmyVo16 in https://github.com/bitwarden/server/pull/7159
• [PM-39293] Remove v2 naming from account recovery command by @eliykat in https://github.com/bitwarden/server/pull/7842
• [BRE-1969] Add Docker login with OAT to Build workflow by @vgrassia in https://github.com/bitwarden/server/pull/7835
• [PM 34707] Use new shared enforce label workflow by @djsmith85 in https://github.com/bitwarden/server/pull/7834
• [BEEEP] - Model Binding for Org and Org User Validation by @jrmccannon in https://github.com/bitwarden/server/pull/7724
• add AccessSecretsManager to OrganizationUserScene by @nthompson-bitwarden in https://github.com/bitwarden/server/pull/7860
• [PM-39474] - Updating Lock Files by @jrmccannon in https://github.com/bitwarden/server/pull/7862
• [PM-33402] Remove Feature-Flagged Logic: pm-33398-refactor-members-invite-org-users-command by @sven-bitwarden in https://github.com/bitwarden/server/pull/7855
• [PM-33403] Remove Feature Flag (pm-33398) by @sven-bitwarden in https://github.com/bitwarden/server/pull/7865
• Add ability to enable SM on SingleOrgScene by @bnagawiecki in https://github.com/bitwarden/server/pull/7861
• [PM-39561] Copy ListResponseModel from Api to HttpExtensions by @Hinton in https://github.com/bitwarden/server/pull/7868
• PM-33964 - Resolve defect in premium user licensing by @theMickster in https://github.com/bitwarden/server/pull/7788
• Bump version to 2026.6.2 by @github-actions[bot] in https://github.com/bitwarden/server/pull/7879

Dependency Updates

• [deps] Platform: Update Microsoft.AspNetCore.SignalR.Protocols.MessagePack to v10.0.9 [SECURITY] by @renovate[bot] in https://github.com/bitwarden/server/pull/7817

Other

• llm(rules): Auth tokenables must be minted via factory. by @enmande in https://github.com/bitwarden/server/pull/7857

Full Changelog: https://github.com/bitwarden/server/compare/v2026.6.1...v2026.6.2