CVE-2026-119414
mediumBitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers t…
Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://abraxaslabs.tech/research/bitwarden-cipher-create-acl disclosure@vulncheck.com
- https://github.com/bitwarden/server disclosure@vulncheck.com
- https://github.com/bitwarden/server/blob/v2026.10.0/src/Api/Vault/Controllers/CiphersContr... disclosure@vulncheck.com
- https://github.com/bitwarden/server/blob/v2026.10.0/src/Infrastructure.EntityFramework/Vau... disclosure@vulncheck.com
- https://github.com/bitwarden/server/commit/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499 disclosure@vulncheck.com
- https://github.com/bitwarden/server/pull/8482 disclosure@vulncheck.com
- https://github.com/bitwarden/server/releases/tag/v2026.10.1 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/bitwarden-server-before-2026.10.1-authorization-bypas... disclosure@vulncheck.com