CVE-2026-119414
Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.
| CWE | CWE-863 |
| Vendor | bitwarden |
| Product | server |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for bitwarden server
Be the first to know when new medium vulnerabilities affecting bitwarden server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
bitwarden / server
0 < 2026.10.1
References
github.com: https://github.com/bitwarden/server/commit/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499 github.com: https://github.com/bitwarden/server/pull/8482 github.com: https://github.com/bitwarden/server/blob/v2026.10.0/src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs#L112 github.com: https://github.com/bitwarden/server/blob/v2026.10.0/src/Api/Vault/Controllers/CiphersController.cs#L355 github.com: https://github.com/bitwarden/server/releases/tag/v2026.10.1 abraxaslabs.tech: https://abraxaslabs.tech/research/bitwarden-cipher-create-acl github.com: https://github.com/bitwarden/server vulncheck.com: https://www.vulncheck.com/advisories/bitwarden-server-before-2026.10.1-authorization-bypass-via-post-api-ciphers-create
Credits
Abraxas Labs Nik Gilmore