Threats tagged 'ghsa-pr8g-2g62-66gf'

Bitwarden Server versions before 2026.10.1 using Entity Framework backends have an authorization bypass vulnerability. This flaw allows organization members to add ciphers to collections they are not authorized to edit. The vulnerability arises because a POST request to /api/ciphers/create with a nulled UserId is treated as administrative, enabling injection of vault items into read-only or inaccessible collections.