bitwarden/server · warning · BadRequestException

You cannot add yourself to groups.

Error message

You cannot add yourself to groups.

What it means

Thrown by PUT /{id} on GroupsController as a BadRequestException('You cannot add yourself to groups.') when the org ability flag AllowAdminAccessToAllCollectionItems is off, the caller is an org user (not a pure provider), is not already a member of the group, and the submitted Users list contains their own OrganizationUser id. It is a deliberate guard against privilege self-elevation; the server reports 400 with the explicit message.

Solutions

1. Exclude the current user's own orgUserId from the submitted Users list before PUT.
2. If self-membership is genuinely required, enable the org's AllowAdminAccessToAllCollectionItems ability (org policy/setting) instead.
3. Have another admin (or owner) add the user to the group.
4. On 400 with this message, filter the user out and retry.

Example fix

// before
model.Users = selectedUserIds; // may include current org user
await api.put(`/organizations/${orgId}/groups/${id}`, model);

// after
model.Users = selectedUserIds.Where(uid => uid != currentOrgUserId).ToArray();
await api.put(`/organizations/${orgId}/groups/${id}`, model);

// Never include the current user's own orgUserId in a group's Users set
var currentOrgUserId = await getCurrentOrgUserIdAsync();
model.Users = model.Users.Where(uid => uid != currentOrgUserId).ToArray();
// If self-membership is required, instead enable AllowAdminAccessToAllCollectionItems

static bool DoesNotAddSelf(IEnumerable<Guid> users, Guid selfOrgUserId)
    => !users.Contains(selfOrgUserId);

try { await api.PutAsync($"/groups/{id}", model); }
catch (ApiException e) when (e.StatusCode == HttpStatusCode.BadRequest
    && e.Message.Contains("yourself"))
{ model.Users = model.Users.Where(u => u != currentOrgUserId).ToArray(); /* retry once */ }

When it happens

Trigger: An admin editing a group and including their own organizationUser id in model.Users while the organization has 'Allow admins to access all collection items' disabled — i.e. self-adding to gain collection access the org policy forbids.

Common situations: Admin manually adding themselves to a group to reach items; client pre-populating the Users set with the current user; copy-paste of a member list that includes the editor; org that tightened the 'admin access to all items' policy after groups were set up.

Related errors

• Resource not found.
• Requested collections must belong to the same organization.
• Resource not found.
• Resource not found.
• Resource not found.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/db02890a5a6417cd. Report an issue: GitHub.

Appendix: source

Thrown at src/Api/AdminConsole/Controllers/GroupsController.cs:168

        var (group, currentAccess) = await _groupRepository.GetByIdWithCollectionsAsync(id);
        if (group == null || group.OrganizationId != orgId)
        {
            throw new NotFoundException();
        }

        // Authorization check:
        // If admins are not allowed access to all collections, you cannot add yourself to a group.
        // No error is thrown for this, we just don't update groups.
        var orgAbility = await _organizationAbilityCacheService.GetOrganizationAbilityAsync(orgId);
        if (!orgAbility.AllowAdminAccessToAllCollectionItems)
        {
            var userId = _userService.GetProperUserId(User).Value;
            var organizationUser = await _organizationUserRepository.GetByOrganizationAsync(orgId, userId);
            var currentGroupUsers = await _groupRepository.GetManyUserIdsByIdAsync(id);
            // OrganizationUser may be null if the current user is a provider
            if (organizationUser != null && !currentGroupUsers.Contains(organizationUser.Id) && model.Users.Contains(organizationUser.Id))
            {
                throw new BadRequestException("You cannot add yourself to groups.");
            }
        }

        // Authorization check:
        // You must have authorization to ModifyUserAccess for all collections being saved
        var postedCollections = await _collectionRepository
            .GetManyByManyIdsAsync(model.Collections.Select(c => c.Id));
        foreach (var collection in postedCollections)
        {
            if (!(await _authorizationService.AuthorizeAsync(User, collection,
                    BulkCollectionOperations.ModifyGroupAccess))
                .Succeeded)
            {
                throw new NotFoundException();
            }
        }

        // The client only sends collections that the saving user has permissions to edit.

View on GitHub (pinned to e93b962371)