bitwarden/server · error · UnauthorizedAccessException

Unauthorized.

Error message

Unauthorized.

What it means

Error "Unauthorized." thrown in bitwarden/server.

Source

Thrown at src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:332

        return new ListResponseModel<OrganizationUserBulkResponseModel>(
            result.Select(t => new OrganizationUserBulkResponseModel(t.Item1.Id, t.Item2)));
    }

    [HttpPost("{id}/reinvite")]
    [Authorize<ManageUsersRequirement>]
    public async Task Reinvite(Guid orgId, Guid id)
    {
        var userId = _userService.GetProperUserId(User);
        await _resendOrganizationInviteCommand.ResendInviteAsync(orgId, userId.Value, id);
    }

    [HttpPost("{organizationUserId}/accept-init")]
    public async Task<IResult> AcceptInit(Guid orgId, Guid organizationUserId, [FromBody] OrganizationUserAcceptInitRequestModel model)
    {
        var user = await _userService.GetUserByPrincipalAsync(User);
        if (user == null)
        {
            throw new UnauthorizedAccessException();
        }

        var request = new InitPendingOrganizationRequest
        {
            User = user,
            OrganizationId = orgId,
            OrganizationUserId = organizationUserId,
            OrganizationKeys = model.Keys.ToPublicKeyEncryptionKeyPairData(),
            CollectionName = model.CollectionName,
            EmailToken = model.Token,
            EncryptedOrganizationSymmetricKey = model.Key
        };

        var result = await _initPendingOrganizationCommand.InitPendingOrganizationAsync(request);

        return Handle(result);
    }

View on GitHub (pinned to e93b962371)

Solutions

1. Confirm the caller is an owner or admin of the organization with permission to manage the targeted members.
2. Ensure the API key or access token used belongs to the organization being modified, not another one.
3. Check custom role permissions if the caller has a custom role.

When it happens

Trigger: Thrown in OrganizationUsersController when the current user lacks permission to perform the requested operation on the organization user, such as managing a user of equal or higher role.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/d4d25758efd73158. Report an issue: GitHub.