CVE-2026-119414 json
Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create
published 2026-10-30 10 d ago modified 2026-10-30 9 d ago also EUVD-2026-113794
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.
Patch / fix
- bitwarden server 2026.10.1
- github.com/bitwarden/server@9030c42 commit
- github.com/bitwarden/server#8482 pull request
- github.com/bitwarden/server/releases/tag/v2026.10.1 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 d ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- bitwarden server
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/bitwarden/server/commit/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499
patch
-
github.com
/bitwarden/server/pull/8482
patch, issue-tracking
-
github.com
/bitwarden/server/blob/v2026.10.0/src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs#L1
technical-description
-
github.com
/bitwarden/server/blob/v2026.10.0/src/Api/Vault/Controllers/CiphersController.cs#L355
technical-description
-
github.com
/bitwarden/server/releases/tag/v2026.10.1
release-notes
-
abraxaslabs.tech
/research/bitwarden-cipher-create-acl
third-party-advisory
-
github.com
/bitwarden/server
product
-
vulncheck.com
/advisories/bitwarden-server-before-2026.10.1-authorization-bypass-via-post-api-ciphers-create
third-party-advisory
Sources
- CVE List CVE-2026-119414
- NVD CVE-2026-119414
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.