bitwarden/server · error · BadRequestException

Trying to share ciphers that you do not own.

Error message

Trying to share ciphers that you do not own.

What it means

Error "Trying to share ciphers that you do not own." thrown in bitwarden/server.

Source

Thrown at src/Api/Vault/Controllers/CiphersController.cs:1255

        var ciphers = await _cipherRepository.GetManyByUserIdAsync(userId, withOrganizations: false);
        var ciphersDict = ciphers.ToDictionary(c => c.Id);

        // Validate the model was encrypted for the posting user
        foreach (var cipher in model.Ciphers)
        {
            if (cipher.EncryptedFor.HasValue && cipher.EncryptedFor.Value != userId)
            {
                _logger.LogError("Cipher was not encrypted for the current user. CipherId: {CipherId}, CurrentUser: {CurrentUserId}, EncryptedFor: {EncryptedFor}", cipher.Id, userId, cipher.EncryptedFor);
                throw new BadRequestException("Cipher was not encrypted for the current user. Please try again.");
            }
        }

        var shareCiphers = new List<(CipherDetails, DateTime?)>();
        foreach (var cipher in model.Ciphers)
        {
            if (!ciphersDict.TryGetValue(cipher.Id.Value, out var existingCipher))
            {
                throw new BadRequestException("Trying to share ciphers that you do not own.");
            }

            ValidateClientVersionForFido2CredentialSupport(existingCipher);

            shareCiphers.Add((cipher.ToCipherDetails(existingCipher), cipher.LastKnownRevisionDate));
        }

        var updated = await _cipherService.ShareManyAsync(
            shareCiphers,
            organizationId,
            model.CollectionIds.Select(Guid.Parse),
            userId
        );

        var response = updated.Select(c => new CipherMiniResponseModel(c, _globalSettings, c.OrganizationUseTotp));
        return new ListResponseModel<CipherMiniResponseModel>(response);
    }

View on GitHub (pinned to e93b962371)

Solutions

1. Only share ciphers from your personal vault or from collections where you have manage permission.
2. Remove the ciphers you do not own from the share request and retry.
3. Ask the owner of those items to share them instead.

When it happens

Trigger: Thrown when a user attempts to share ciphers to an organization that belong to another user or that the user does not own.

Common situations: See trigger scenarios.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/78d4dcfe135a9ee9. Report an issue: GitHub.