---
id: CVE-2026-119414
title: >-
  Bitwarden Server before 2026.10.1 Authorization Bypass via POST
  /api/ciphers/create
summary: >-
  Bitwarden Server before 2026.10.1 on Entity Framework backends contains an
  authorization bypass vulnerability that allows organization members to add
  ciphers to collections they cannot edit. Attackers can call POST
  /api/ciphers/create, w…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: bitwarden
product: server
affected:
  - server < 2026.10.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T16:37:32.248638Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T16:37:45.394Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119414'
references:
  - url: >-
      https://github.com/bitwarden/server/commit/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499
  - url: 'https://github.com/bitwarden/server/pull/8482'
  - url: >-
      https://github.com/bitwarden/server/blob/v2026.10.0/src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs#L112
  - url: >-
      https://github.com/bitwarden/server/blob/v2026.10.0/src/Api/Vault/Controllers/CiphersController.cs#L355
  - url: 'https://github.com/bitwarden/server/releases/tag/v2026.10.1'
    label: server v2026.10.1 Release Notes
  - url: 'https://abraxaslabs.tech/research/bitwarden-cipher-create-acl'
  - url: 'https://github.com/bitwarden/server'
  - url: >-
      https://www.vulncheck.com/advisories/bitwarden-server-before-2026.10.1-authorization-bypass-via-post-api-ciphers-create
    label: >-
      VulnCheck Advisory: Bitwarden Server before 2026.10.1 Authorization Bypass
      via POST /api/ciphers/create
tags:
  - cve.org
epss: 0.00361
epssPercentile: 0.30036
ingestedAt: '2026-11-05T16:24:31.080Z'
---

## Overview

Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.

## Affected

- `server < 2026.10.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.