{"record":{"id":"5326b9e1b7720ad4","repo":"bitwarden/server","slug":"unauthorized-5326b9","errorCode":null,"errorMessage":"Unauthorized.","messagePattern":"Unauthorized\\.","errorType":"http","errorClass":"UnauthorizedAccessException","httpStatus":401,"severity":"error","filePath":"src/Api/Vault/Controllers/CiphersController.cs","lineNumber":1287,"sourceCode":"\n        var response = updated.Select(c => new CipherMiniResponseModel(c, _globalSettings, c.OrganizationUseTotp));\n        return new ListResponseModel<CipherMiniResponseModel>(response);\n    }\n\n    [HttpPost(\"share\")]\n    [Obsolete(\"This endpoint is deprecated. Use PUT method instead.\")]\n    public async Task<ListResponseModel<CipherMiniResponseModel>> PostShareMany([FromBody] CipherBulkShareRequestModel model)\n    {\n        return await PutShareMany(model);\n    }\n\n    [HttpPost(\"purge\")]\n    public async Task PostPurge([FromBody] SecretVerificationRequestModel model, Guid? organizationId = null)\n    {\n        var user = await _userService.GetUserByPrincipalAsync(User);\n        if (user == null)\n        {\n            throw new UnauthorizedAccessException();\n        }\n\n        if (!await _userService.VerifySecretAsync(user, model.Secret))\n        {\n            ModelState.AddModelError(string.Empty, \"User verification failed.\");\n            await Task.Delay(2000);\n            throw new BadRequestException(ModelState);\n        }\n\n        if (organizationId == null)\n        {\n            // Check if the user is claimed by any organization.\n            if (await _userService.IsClaimedByAnyOrganizationAsync(user.Id))\n            {\n                throw new BadRequestException(new CannotPurgeClaimedAccountError().Message);\n            }\n            await _cipherRepository.DeleteByUserIdAsync(user.Id);\n        }","sourceCodeStart":1269,"sourceCodeEnd":1305,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Vault/Controllers/CiphersController.cs#L1269-L1305","documentation":"Error \"Unauthorized.\" thrown in bitwarden/server.","triggerScenarios":"Thrown in CiphersController when the current user is not authorized to perform the requested cipher operation, such as accessing or modifying another user's or organization's cipher.","commonSituations":"See trigger scenarios.","solutions":["Confirm you have manage permission on the collection containing the ciphers being modified.","Ask an owner or admin to grant the required collection permissions.","Verify the request targets the organization your credentials belong to."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}