Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119414Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create

Medium 4.3

In plain English

A medium-severity incorrect authorization in server from bitwarden. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 70.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.

Affected products (as reported)

Vendor	Product	Versions
bitwarden	server	0 – before 2026.10.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/bitwarden/server/commit/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499 patch
https://github.com/bitwarden/server/pull/8482 patch, issue-tracking
https://github.com/bitwarden/server/blob/v2026.10.0/src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs#L112 technical-description
https://github.com/bitwarden/server/blob/v2026.10.0/src/Api/Vault/Controllers/CiphersController.cs#L355 technical-description
server v2026.10.1 Release Notes release-notes
https://abraxaslabs.tech/research/bitwarden-cipher-create-acl third-party-advisory
https://github.com/bitwarden/server product
VulnCheck Advisory: Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create third-party-advisory