{"record":{"id":"db02890a5a6417cd","repo":"bitwarden/server","slug":"you-cannot-add-yourself-to-groups","errorCode":null,"errorMessage":"You cannot add yourself to groups.","messagePattern":"You cannot add yourself to groups\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"src/Api/AdminConsole/Controllers/GroupsController.cs","lineNumber":168,"sourceCode":"        var (group, currentAccess) = await _groupRepository.GetByIdWithCollectionsAsync(id);\n        if (group == null || group.OrganizationId != orgId)\n        {\n            throw new NotFoundException();\n        }\n\n        // Authorization check:\n        // If admins are not allowed access to all collections, you cannot add yourself to a group.\n        // No error is thrown for this, we just don't update groups.\n        var orgAbility = await _organizationAbilityCacheService.GetOrganizationAbilityAsync(orgId);\n        if (!orgAbility.AllowAdminAccessToAllCollectionItems)\n        {\n            var userId = _userService.GetProperUserId(User).Value;\n            var organizationUser = await _organizationUserRepository.GetByOrganizationAsync(orgId, userId);\n            var currentGroupUsers = await _groupRepository.GetManyUserIdsByIdAsync(id);\n            // OrganizationUser may be null if the current user is a provider\n            if (organizationUser != null && !currentGroupUsers.Contains(organizationUser.Id) && model.Users.Contains(organizationUser.Id))\n            {\n                throw new BadRequestException(\"You cannot add yourself to groups.\");\n            }\n        }\n\n        // Authorization check:\n        // You must have authorization to ModifyUserAccess for all collections being saved\n        var postedCollections = await _collectionRepository\n            .GetManyByManyIdsAsync(model.Collections.Select(c => c.Id));\n        foreach (var collection in postedCollections)\n        {\n            if (!(await _authorizationService.AuthorizeAsync(User, collection,\n                    BulkCollectionOperations.ModifyGroupAccess))\n                .Succeeded)\n            {\n                throw new NotFoundException();\n            }\n        }\n\n        // The client only sends collections that the saving user has permissions to edit.","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/AdminConsole/Controllers/GroupsController.cs#L150-L186","documentation":"Thrown by PUT /{id} on GroupsController as a BadRequestException('You cannot add yourself to groups.') when the org ability flag AllowAdminAccessToAllCollectionItems is off, the caller is an org user (not a pure provider), is not already a member of the group, and the submitted Users list contains their own OrganizationUser id. It is a deliberate guard against privilege self-elevation; the server reports 400 with the explicit message.","triggerScenarios":"An admin editing a group and including their own organizationUser id in model.Users while the organization has 'Allow admins to access all collection items' disabled — i.e. self-adding to gain collection access the org policy forbids.","commonSituations":"Admin manually adding themselves to a group to reach items; client pre-populating the Users set with the current user; copy-paste of a member list that includes the editor; org that tightened the 'admin access to all items' policy after groups were set up.","solutions":["Exclude the current user's own orgUserId from the submitted Users list before PUT.","If self-membership is genuinely required, enable the org's AllowAdminAccessToAllCollectionItems ability (org policy/setting) instead.","Have another admin (or owner) add the user to the group.","On 400 with this message, filter the user out and retry."],"exampleFix":"// before\nmodel.Users = selectedUserIds; // may include current org user\nawait api.put(`/organizations/${orgId}/groups/${id}`, model);\n\n// after\nmodel.Users = selectedUserIds.Where(uid => uid != currentOrgUserId).ToArray();\nawait api.put(`/organizations/${orgId}/groups/${id}`, model);","handlingStrategy":"validation","validationCode":"// Never include the current user's own orgUserId in a group's Users set\nvar currentOrgUserId = await getCurrentOrgUserIdAsync();\nmodel.Users = model.Users.Where(uid => uid != currentOrgUserId).ToArray();\n// If self-membership is required, instead enable AllowAdminAccessToAllCollectionItems","typeGuard":"static bool DoesNotAddSelf(IEnumerable<Guid> users, Guid selfOrgUserId)\n    => !users.Contains(selfOrgUserId);","tryCatchPattern":"try { await api.PutAsync($\"/groups/{id}\", model); }\ncatch (ApiException e) when (e.StatusCode == HttpStatusCode.BadRequest\n    && e.Message.Contains(\"yourself\"))\n{ model.Users = model.Users.Where(u => u != currentOrgUserId).ToArray(); /* retry once */ }","preventionTips":["Strip the current user's orgUserId from submitted Users before PUT.","Prefer enabling the org 'admin access to all items' ability over self-adding to a group.","Do not pre-populate the Users editor with the current user."],"tags":["bitwarden","api","http-400","groups","authorization","self-elevation"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}