{"record":{"id":"bf4effade28fd0e4","repo":"bitwarden/server","slug":"not-enough-privileges-to-import-into-this-organiza","errorCode":null,"errorMessage":"Not enough privileges to import into this organization.","messagePattern":"Not enough privileges to import into this organization\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Tools/Controllers/ImportCiphersController.cs","lineNumber":83,"sourceCode":"    {\n        if (!_globalSettings.SelfHosted &&\n            (model.Ciphers.Length > _globalSettings.ImportCiphersLimitation.CiphersLimit ||\n             model.CollectionRelationships.Length > _globalSettings.ImportCiphersLimitation.CollectionRelationshipsLimit ||\n             model.Collections.Length > _globalSettings.ImportCiphersLimitation.CollectionsLimit ||\n             model.Folders.Length > _globalSettings.ImportCiphersLimitation.FoldersLimit ||\n             model.FolderRelationships.Length > _globalSettings.ImportCiphersLimitation.FolderRelationshipsLimit))\n        {\n            throw new BadRequestException(\"You cannot import this much data at once.\");\n        }\n\n        var orgId = new Guid(organizationId);\n        var collections = model.Collections.Select(c => c.ToCollection(orgId)).ToList();\n\n        // A User is allowed to import if CanCreate Collections or has AccessToImportExport\n        var authorized = await CheckOrgImportPermissionAsync(collections, orgId);\n        if (!authorized)\n        {\n            throw new BadRequestException(\"Not enough privileges to import into this organization.\");\n        }\n\n        var userId = _userService.GetProperUserId(User) ?? throw new InvalidOperationException(\"User ID not found\");\n        var ciphers = model.Ciphers.Select(l => l.ToOrganizationCipherDetails(orgId)).ToList();\n        var folders = model.Folders.Select(f => f.ToFolder(userId)).ToList();\n        await _importCiphersCommand.ImportIntoOrganizationalVaultAsync(collections, ciphers, model.CollectionRelationships, userId, folders, model.FolderRelationships);\n    }\n\n    private async Task<bool> CheckOrgImportPermissionAsync(List<Collection> collections, Guid orgId)\n    {\n        //Users are allowed to import if they have the AccessToImportExport permission\n        if (await _currentContext.AccessImportExport(orgId))\n        {\n            return true;\n        }\n\n        //Calling Repository instead of Service as we want to get all the collections, regardless of permission\n        //Permissions check will be done later on AuthorizationService","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Tools/Controllers/ImportCiphersController.cs#L65-L101","documentation":"Thrown by PostImportOrganization when CheckOrgImportPermissionAsync returns false — the caller lacks sufficient privileges to import into the target organization. Permission is granted if the user has AccessImportExport, or if they can create collections (for new collections) and/or import ciphers into existing collections (BulkCollectionOperations.ImportCiphers). None of those conditions were met.","triggerScenarios":"POST /ciphers/import-organization by a user who is not an org admin, does not have the AccessImportExport permission, and does not have collection-create or collection-import permissions on the target collections.","commonSituations":"A standard org member tries to import into an org vault without delegated import privileges; a custom role lacks the Import/Export permission; the user can manage some collections but the import includes new collections they cannot create.","solutions":["Have an org admin grant the user the 'Access Import/Export' permission or a custom role with import privileges.","Ensure the user has CreateCollection permission if the import includes new collections, or ImportCiphers permission for existing collections.","If importing into existing collections only, confirm the user has manage or import access on all target collections.","Perform the import as an org admin if role delegation is not feasible."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify import permissions before calling the endpoint\nif (!await currentContext.AccessImportExport(orgId)\n    && !await authService.AuthorizeAsync(User, collections, BulkCollectionOperations.Create) &&\n    && !await authService.AuthorizeAsync(User, existingCollections, BulkCollectionOperations.ImportCiphers))\n{\n    return Forbid(\"Not enough privileges to import into this organization.\");\n}\nawait importClient.ImportOrganizationAsync(orgId, model);","typeGuard":null,"tryCatchPattern":"try { await client.ImportOrganizationAsync(orgId, model); }\ncatch (ApiException ex) when (ex.Message.Contains(\"Not enough privileges\"))\n{\n    // Prompt user to request AccessImportExport or collection permissions from admin\n    NotifyUser(\"Contact an org admin to grant import permissions.\");\n}","preventionTips":["Have org admins grant 'Access Import/Export' to users who need to import.","Verify collection create/import permissions before importing into specific collections.","Only show the org-import option to users with sufficient privileges."],"tags":["import","authorization","organization","permissions","bitwarden"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}