جزئیات آسیب‌پذیری

Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.

• https://github.com/bitwarden/server/commit/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499 patch
• https://github.com/bitwarden/server/pull/8482 patchissue-tracking
• https://github.com/bitwarden/server/blob/v2026.10.0/src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs#L112 technical-description
• https://github.com/bitwarden/server/blob/v2026.10.0/src/Api/Vault/Controllers/CiphersController.cs#L355 technical-description
• https://github.com/bitwarden/server/releases/tag/v2026.10.1 release-notes
• https://abraxaslabs.tech/research/bitwarden-cipher-create-acl third-party-advisory
• https://github.com/bitwarden/server product
• https://www.vulncheck.com/advisories/bitwarden-server-before-2026.10.1-authorization-bypass-via-post-api-ciphers-create third-party-advisory