CVE-2026-119414
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.
Risk Assessment
An organization member can inject items into collections they should not access, violating access control and potentially introducing malicious or misleading data into other users' vaults. An organization account is required.
Recommendation
Update Bitwarden Server to version 2026.10.1 or later and review organization members' collection permissions.
Other vulnerabilities in Bitwarden Server
See all- CVE-2026-101878High
Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.
- CVE-2026-71959Medium
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.
- CVE-2026-60104High
A vulnerability in Bitwarden Server before 2026.6.0 allows a low-privileged organization member to obtain another user's vault key and access token. The attacker creates a Trusted Device Encryption authentication request bound to their own public key, and once approved by the victim, the data is readable from an unauthenticated endpoint, leading to account takeover.
- CVE-2026-57522Low
Bitwarden Server before 2026.5.0 has a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(). An authenticated organization member can set their display name to JSON metacharacters, injecting arbitrary key-value pairs into JSON payloads sent to configured event integrations (webhook, SIEM, Slack, Teams, Datadog).
- CVE-2026-57521Medium
A broken access control vulnerability in Bitwarden Server before 2026.5.0 allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints. The missing ManageOrganizationBillingRequirement enables attackers to retrieve Stripe-computed tax totals, subscription status, and billing details.
- CVE-2026-57520High
A privilege escalation vulnerability in Bitwarden Server before 2026.5.0 allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint.
- CVE-2026-43640High
A vulnerability in Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key. This allows an authenticated user with SCIM management privileges to obtain the key using only a valid session.
- CVE-2026-43639High
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via POST /providers/{providerId}/clients/existing, resulting in takeover of the target organization. Self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).
- CVE-2026-43638Medium
Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via POST /ciphers/import-organization by submitting an empty collections array, which causes the server-side permission check to be skipped.
Original NVD description (English source)
Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS