Read the docs
TI-2026-82993 Aliases CVE-2026-119414GHSA-pr8g-2g62-66gf

Authorization bypass in Bitwarden Server lets members add vault items

Priority LOW 24CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass that allows organization members to add ciphers to collections they cannot edit. An attacker with low privileges can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items into collections that are read-only or inaccessible to their members. The flaw is classified as CWE-863, Incorrect Authorization.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00361 30th percentileScored 2026-11-07
Fix Fixed server (bitwarden): 2026.10.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bitwardenserverbefore 2026.10.12026.10.1Patch availableCNA
  • server Vendorbitwarden Affected before 2026.10.1 Fixed in 2026.10.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bitwarden:server:*:*:*:*:*:*:*:*——bitwarden
  • cpe:2.3:a:bitwarden:server:*:*:*:*:*:*:*:* Versions — — ·bitwarden

Remediation

Bitwarden Server is fixed in version 2026.10.1, so upgrade to that version or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA server (bitwarden) Fixed in 2026.10.1

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119414
  2. 2026-10-30 Alias added: GHSA-pr8g-2g62-66gf
  3. 2026-10-30 CISA SSVC decision points changed

References

Patch 2

Advisory 1

Other 4

  • TI-2026-42828 Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request CVSS 4.0CRITICAL 9.3
  • TI-2026-31741 Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients CVSS 4.0HIGH 8.9
  • TI-2026-31742 Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key CVSS 4.0HIGH 8.6
  • TI-2026-65186 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation CVSS 4.0HIGH 7.7
  • TI-2023-12564 Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain… CVSS 3.1HIGH 7.5
  • TI-2023-12369 Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in… CVSS 3.1HIGH 7.1
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences