bitwarden/server · error · UnauthorizedAccessException

Unauthorized.

Error message

Unauthorized.

What it means

Error "Unauthorized." thrown in bitwarden/server.

Source

Thrown at src/Api/Vault/Controllers/CiphersController.cs:1287

        var response = updated.Select(c => new CipherMiniResponseModel(c, _globalSettings, c.OrganizationUseTotp));
        return new ListResponseModel<CipherMiniResponseModel>(response);
    }

    [HttpPost("share")]
    [Obsolete("This endpoint is deprecated. Use PUT method instead.")]
    public async Task<ListResponseModel<CipherMiniResponseModel>> PostShareMany([FromBody] CipherBulkShareRequestModel model)
    {
        return await PutShareMany(model);
    }

    [HttpPost("purge")]
    public async Task PostPurge([FromBody] SecretVerificationRequestModel model, Guid? organizationId = null)
    {
        var user = await _userService.GetUserByPrincipalAsync(User);
        if (user == null)
        {
            throw new UnauthorizedAccessException();
        }

        if (!await _userService.VerifySecretAsync(user, model.Secret))
        {
            ModelState.AddModelError(string.Empty, "User verification failed.");
            await Task.Delay(2000);
            throw new BadRequestException(ModelState);
        }

        if (organizationId == null)
        {
            // Check if the user is claimed by any organization.
            if (await _userService.IsClaimedByAnyOrganizationAsync(user.Id))
            {
                throw new BadRequestException(new CannotPurgeClaimedAccountError().Message);
            }
            await _cipherRepository.DeleteByUserIdAsync(user.Id);
        }

View on GitHub (pinned to e93b962371)

Solutions

1. Confirm you have manage permission on the collection containing the ciphers being modified.
2. Ask an owner or admin to grant the required collection permissions.
3. Verify the request targets the organization your credentials belong to.

When it happens

Trigger: Thrown in CiphersController when the current user is not authorized to perform the requested cipher operation, such as accessing or modifying another user's or organization's cipher.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/5326b9e1b7720ad4. Report an issue: GitHub.