CVE-2026-119414— Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create

Quick assessment

Affected

bitwarden server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 2026.10.1 之前的 Bitwarden Server（使用 Entity Framework 后端）中存在一个授权绕过漏洞。该漏洞允许组织成员向无法编辑的集合中添加密码条目（ciphers）。攻击者可以调用接口，其中被置为空的会被当作管理员权限处理，从而将保险库条目注入到仅读或无法访问的集合成员中。

CVSS 4.3 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create

Source: CVE Program / CVE List V5

Vulnerability Description

Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
bitwarden	server	0 ~ 2026.10.1	-

II. Public POCs for CVE-2026-119414

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119414

请登录查看更多情报信息。

Other References for CVE-2026-119414 (5)

🔗 GitHub - bitwarden/server: Bitwarden infrastructure/backend (API, database, Docker, etc). · GitHub product
🔗 PM-37176: Add collection permission checks to create cipher endpoint. by nikwithak · Pull Request #8482 · bitwarden/server patch issue-tracking
Bitwarden, EF cipher create skips collection ACL · Abraxas Labs third-party-advisory
🔗 Release Version 2026.10.1 · bitwarden/server · GitHub Read full article release-notes
🔗 Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119414

IV. Related Vulnerabilities

Same product: server

Same vendor: bitwarden

Same weakness: CWE-863