SZB-57de6dff16
EUVD-2026-113794 reports authorization bypass in Bitwarden Server collections
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Bitwarden
- Product
- Bitwarden Server
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-113794 describes an authorization bypass in Bitwarden Server before 2026.10.1 on Entity Framework backends. It is scored 5.3/10 (CVSS v3.1) and allows organization members to add ciphers to collections they cannot edit.
If you use Bitwarden
Upgrade Bitwarden Server to 2026.10.1 or later
Review collection permissions in each organization
Audit recently added items in collections that members cannot edit
What the sources say 1
· Mastodon: “Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit.” Source