Authorization Bypass in Bitwarden Server via Null UserId

Executive Summary

This vulnerability is an authorization bypass in Bitwarden Server before version 2026.10.1. It allows organization members to add ciphers to collections they do not have permission to edit. Attackers can exploit this by sending a POST request to /api/ciphers/create with a null UserId, which the system incorrectly treats as an administrative request. This enables unauthorized injection of vault items into read-only or inaccessible collections.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to /api/ciphers/create endpoints. Look for requests with a null UserId parameter, which may indicate exploitation attempts. Check server logs for unauthorized cipher creation events in collections where the user lacks edit permissions.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to add sensitive vault items to collections they should not access. This may lead to data leaks, unauthorized sharing of credentials, or compromise of shared vaults. Users relying on read-only or restricted collections could unknowingly receive injected items, potentially exposing confidential information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). It undermines access control mechanisms, potentially resulting in data breaches that require regulatory reporting and penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Bitwarden Server to version 2026.10.1 or later. If upgrading is not possible, restrict access to the /api/ciphers/create endpoint and implement strict input validation to reject requests with null UserId values. Review and remove any unauthorized ciphers added to collections.

Useful 0 Not Useful 0