Description
Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| bitwarden | server | < 2026.10.1 | 2026.10.1 |
Advisories 1
- WID-SEC-2026-4261 Bitwarden: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 1, 2026
References
- https://github.com/bitwarden/server/commit/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499 patch
- https://github.com/bitwarden/server/pull/8482 patch issue-tracking
- https://github.com/bitwarden/server/blob/v2026.10.0/src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs#L112 technical-description
- https://github.com/bitwarden/server/blob/v2026.10.0/src/Api/Vault/Controllers/CiphersController.cs#L355 technical-description
- server v2026.10.1 Release Notes release-notes
- https://abraxaslabs.tech/research/bitwarden-cipher-create-acl third-party-advisory
- https://github.com/bitwarden/server product
- VulnCheck Advisory: Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create third-party-advisory