---
id: "CVE-2026-119414"
kind: "vulnerability"
aliases: ["CVE-2026-119414"]
title: "Bitwarden Server: organization members can add vault items to read-only collections"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bitwarden", "package", "password-manager", "self-hosted"]
not_affected_if: ["managed-hosting", "non-entity-framework-backend"]
published_at: "2026-10-30T12:16:37+00:00"
first_seen_at: "2026-10-30T12:30:23+00:00"
updated_at: "2026-10-30T12:33:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119414", "first_seen_at": "2026-10-30T12:30:23+00:00"}]
---

# Bitwarden Server: organization members can add vault items to read-only collections

Bitwarden Server versions before 2026.10.1 running on Entity Framework backends let organization members add ciphers to collections they cannot edit. An attacker can call POST /api/ciphers/create with a nulled UserId, which is treated as administrative, to inject vault items into read-only or inaccessible collections.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Bitwarden Server version you run against `2026.10.1`; anything older is in the stated range.
- Confirm whether the deployment uses an Entity Framework backend; the sources name that as the affected configuration.

## Fix

- Bitwarden Server: move to `2026.10.1` or later.

## Timeline

- 2026-10-30T12:30:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119414

## From the sources

Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_