CVE-2026-119414 in Server
Summary
by MITRE • 10/30/2026
Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified security flaw resides within the Bitwarden Server application prior to version 2026.10.1, specifically affecting deployments that utilize Entity Framework as their backend data access layer. This vulnerability constitutes a critical authorization bypass mechanism that undermines the fundamental principle of least privilege enforced by the platform's organizational structure. The core technical deficiency stems from improper validation logic within the cipher creation endpoint, where the system fails to adequately verify the relationship between the authenticated user and the target collection before allowing modifications. By exploiting this gap, an attacker who possesses valid credentials for a standard organization member account can manipulate internal request parameters to bypass access control checks that are designed to restrict write operations on specific collections.
The operational mechanism of this exploit involves interacting with the POST /api/ciphers/create endpoint. Under normal circumstances, this API call requires strict validation ensuring that the requesting user has explicit edit permissions for the collection associated with the cipher being created. However, due to a logic error in how the UserId parameter is processed within the Entity Framework backend, an attacker can inject a null or nulled value into specific fields of the request payload. The application's internal handling treats this nulled identifier as equivalent to an administrative context or ignores it entirely during permission checks. This misinterpretation allows the malicious actor to bypass the standard authorization middleware that would normally reject such requests from non-administrative users, effectively granting them elevated privileges for a single operation without requiring actual admin rights.
The impact of this vulnerability is significant within multi-tenant organizational environments where data isolation between collections is paramount. Attackers can inject sensitive vault items into collections to which they should not have access, including read-only or completely inaccessible groups. This action results in the synchronization of unauthorized ciphertexts to all members of those restricted collections. Consequently, users who are supposed to be unable to view specific secrets may inadvertently receive and decrypt them on their devices upon syncing with the server. This leads to a direct compromise of confidentiality for sensitive credentials, API keys, or personal identification information stored within those targeted collections, potentially exposing organizational data to unauthorized parties without any alerting mechanism in place during the initial injection phase.
From an industry standard perspective, this vulnerability aligns closely with CWE-285 Improper Authorization and CWE-601 URL Redirection to Untrusted Site (SSRF) if considered through the lens of parameter manipulation leading to unintended state changes. In terms of offensive security frameworks, it maps to MITRE ATT&CK technique T1078 Valid Accounts, as the attacker leverages legitimate but insufficiently privileged credentials to achieve unauthorized access, and potentially T1530 Data from Cloud Storage Object if viewed through the lens of data exfiltration via synchronization. The flaw highlights a common pitfall in web application development where backend ORM frameworks like Entity Framework may mask underlying logic errors by automatically handling certain null values or default behaviors that developers fail to explicitly secure against malicious input variations.
To mitigate this risk, organizations running Bitwarden Server must immediately upgrade to version 2026.10.1 or later, which contains the necessary patches for these authorization checks. Until an upgrade is feasible, administrators should enforce strict network-level controls and WAF rules that inspect POST requests to cipher endpoints for anomalous parameter structures, particularly looking for null values in user identification fields where they are not expected by standard API contracts. Additionally, implementing rigorous input validation on the client side can serve as a secondary defense layer, although server-side enforcement remains the primary requirement for security. Regular auditing of collection permissions and monitoring logs for unusual synchronization patterns from member accounts can also help detect potential exploitation attempts in real-time before significant data exposure occurs.