Bitwarden Server versions prior to 2026.10.1 running on Entity Framework backends allow an authenticated organization member to add cipher items to collections they do not have edit rights for. A POST request to /api/ciphers/create with a nulled UserId is treated as an administrative action, enabling the insertion of vault items into read‑only or otherwise inaccessible collections. The flaw does not lead to remote code execution but permits data integrity violations and can expose sensitive credentials to unintended recipients.

The vulnerability affects the Bitwarden Server product (bitwarden:server) for all releases before 2026.10.1. Backends using Entity Framework are impacted; the issue resides in the CiphersController and CipherRepository logic as referenced in the source code.

The CVSS base score of 5.3 indicates moderate severity. EPSS data is not available and the flaw is not listed in the CISA KEV catalog, implying no high‑profile exploits yet. The attack vector requires a legitimate user account within an organization; an attacker with such credentials can abuse the endpoint to bypass collection permissions, but no external execution vector is apparent.