Live › vulnerability › CVE-2026-119414
Bitwarden Server versions before 2026.10.1 running on Entity Framework backends let organization members add ciphers to collections they cannot edit. An attacker can call POST /api/ciphers/create with a nulled UserId, which is treated as administrative, to inject vault items into read-only or inaccessible collections.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Self-hosted Bitwarden Server deployments on Entity Framework backends that use organization collections are exposed. Any organization member can reach the create endpoint, so the exposure is wider than admins. Deployments on Bitwarden's managed cloud or on non-Entity Framework backends are not described as affected.
No product ranges from the sources yet.
2026.10.1; anything older is in the stated range.2026.10.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.
This page as .md · .json · in your agent: get_signal("CVE-2026-119414")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.