bitwarden/server · warning · BadRequestException

You cannot add yourself to groups.

Error message

You cannot add yourself to groups.

What it means

Thrown by PUT /{id} on GroupsController as a BadRequestException('You cannot add yourself to groups.') when the org ability flag AllowAdminAccessToAllCollectionItems is off, the caller is an org user (not a pure provider), is not already a member of the group, and the submitted Users list contains their own OrganizationUser id. It is a deliberate guard against privilege self-elevation; the server reports 400 with the explicit message.

Source

Thrown at src/Api/AdminConsole/Controllers/GroupsController.cs:168

        var (group, currentAccess) = await _groupRepository.GetByIdWithCollectionsAsync(id);
        if (group == null || group.OrganizationId != orgId)
        {
            throw new NotFoundException();
        }

        // Authorization check:
        // If admins are not allowed access to all collections, you cannot add yourself to a group.
        // No error is thrown for this, we just don't update groups.
        var orgAbility = await _organizationAbilityCacheService.GetOrganizationAbilityAsync(orgId);
        if (!orgAbility.AllowAdminAccessToAllCollectionItems)
        {
            var userId = _userService.GetProperUserId(User).Value;
            var organizationUser = await _organizationUserRepository.GetByOrganizationAsync(orgId, userId);
            var currentGroupUsers = await _groupRepository.GetManyUserIdsByIdAsync(id);
            // OrganizationUser may be null if the current user is a provider
            if (organizationUser != null && !currentGroupUsers.Contains(organizationUser.Id) && model.Users.Contains(organizationUser.Id))
            {
                throw new BadRequestException("You cannot add yourself to groups.");
            }
        }

        // Authorization check:
        // You must have authorization to ModifyUserAccess for all collections being saved
        var postedCollections = await _collectionRepository
            .GetManyByManyIdsAsync(model.Collections.Select(c => c.Id));
        foreach (var collection in postedCollections)
        {
            if (!(await _authorizationService.AuthorizeAsync(User, collection,
                    BulkCollectionOperations.ModifyGroupAccess))
                .Succeeded)
            {
                throw new NotFoundException();
            }
        }

        // The client only sends collections that the saving user has permissions to edit.

View on GitHub (pinned to e93b962371)

Solutions

1. Exclude the current user's own orgUserId from the submitted Users list before PUT.
2. If self-membership is genuinely required, enable the org's AllowAdminAccessToAllCollectionItems ability (org policy/setting) instead.
3. Have another admin (or owner) add the user to the group.
4. On 400 with this message, filter the user out and retry.

Example fix

// before
model.Users = selectedUserIds; // may include current org user
await api.put(`/organizations/${orgId}/groups/${id}`, model);

// after
model.Users = selectedUserIds.Where(uid => uid != currentOrgUserId).ToArray();
await api.put(`/organizations/${orgId}/groups/${id}`, model);

// Never include the current user's own orgUserId in a group's Users set
var currentOrgUserId = await getCurrentOrgUserIdAsync();
model.Users = model.Users.Where(uid => uid != currentOrgUserId).ToArray();
// If self-membership is required, instead enable AllowAdminAccessToAllCollectionItems

static bool DoesNotAddSelf(IEnumerable<Guid> users, Guid selfOrgUserId)
    => !users.Contains(selfOrgUserId);

try { await api.PutAsync($"/groups/{id}", model); }
catch (ApiException e) when (e.StatusCode == HttpStatusCode.BadRequest
    && e.Message.Contains("yourself"))
{ model.Users = model.Users.Where(u => u != currentOrgUserId).ToArray(); /* retry once */ }

When it happens

Trigger: An admin editing a group and including their own organizationUser id in model.Users while the organization has 'Allow admins to access all collection items' disabled — i.e. self-adding to gain collection access the org policy forbids.

Common situations: Admin manually adding themselves to a group to reach items; client pre-populating the Users set with the current user; copy-paste of a member list that includes the editor; org that tightened the 'admin access to all items' policy after groups were set up.

Related errors

• Resource not found.
• Requested collections must belong to the same organization.
• Unauthorized.
• Resource not found.
• Resource not found.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/db02890a5a6417cd. Report an issue: GitHub.