{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/bitwarden-nested-collection-no-access-inheritance/", "item": { "id": "https://update.dsesecurity.com/updates/bitwarden-nested-collection-no-access-inheritance/", "slug": "bitwarden-nested-collection-no-access-inheritance", "url": "https://update.dsesecurity.com/updates/bitwarden-nested-collection-no-access-inheritance/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/bitwarden-nested-collection-no-access-inheritance.md", "json": "https://update.dsesecurity.com/api/v1/posts/bitwarden-nested-collection-no-access-inheritance/" }, "title": "Do not infer Bitwarden collection permissions from the folder-like hierarchy", "summary": "Nesting organizes the list; it does not copy a parent collection’s access or items.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:33:49+00:00", "modified_at": "2026-10-15T13:36:17+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 264, "potentially_affected": "This concerns Bitwarden organization collections and their visual nesting. Personal-vault folders, group membership, and organization administrative roles are separate concepts with different effects.", "dse_recommendation": "DSE recommends maintaining a collection-to-group access table independent of the visual hierarchy.", "primary_source": { "name": "Bitwarden — Collections", "url": "https://bitwarden.com/help/about-collections/", "published_on": null, "authority": "bitwarden.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Nesting organizes the list; it does not copy a parent collection’s access or items.

\n

Source facts

\n

Bitwarden collections group organization-owned items for sharing, and the organization can assign access to users or groups. An organization-owned item must belong to at least one collection, while its ownership stays with the organization rather than an individual user. The documentation makes a specific distinction about nested collections: nesting changes how the collection list appears in the vault filter. It does not cause the child collection to inherit its parent’s items, access, or permissions. Those assignments must be configured independently.

\n

Source: Bitwarden — Collections.

\n

Applicability

\n

This concerns Bitwarden organization collections and their visual nesting. Personal-vault folders, group membership, and organization administrative roles are separate concepts with different effects.

\n

DSE recommendation

\n

DSE recommends maintaining a collection-to-group access table independent of the visual hierarchy. When creating a nested collection, review its explicit permissions and intended items instead of assuming the parent establishes a boundary. Use names that help users find information without implying inheritance that does not exist. During a restructure, check both old and new assignments before moving sensitive items. Keep organization ownership and collection access visible in the change record so a tidy-looking list does not hide unintended sharing.

\n

Verification

\n

Create parent and child test collections with different synthetic items and access groups. Confirm that access to the parent alone does not reveal the child’s items. Add the intended child assignment and retest. Review effective permissions through every relevant group and individual assignment before applying the structure to production data.

\n

Official reference

\n

Bitwarden — Collections. Reviewed October 15, 2026.

", "content_text": "Nesting organizes the list; it does not copy a parent collection’s access or items.\nSource facts\nBitwarden collections group organization-owned items for sharing, and the organization can assign access to users or groups. An organization-owned item must belong to at least one collection, while its ownership stays with the organization rather than an individual user. The documentation makes a specific distinction about nested collections: nesting changes how the collection list appears in the vault filter. It does not cause the child collection to inherit its parent’s items, access, or permissions. Those assignments must be configured independently.\nSource: Bitwarden — Collections.\nApplicability\nThis concerns Bitwarden organization collections and their visual nesting. Personal-vault folders, group membership, and organization administrative roles are separate concepts with different effects.\nDSE recommendation\nDSE recommends maintaining a collection-to-group access table independent of the visual hierarchy. When creating a nested collection, review its explicit permissions and intended items instead of assuming the parent establishes a boundary. Use names that help users find information without implying inheritance that does not exist. During a restructure, check both old and new assignments before moving sensitive items. Keep organization ownership and collection access visible in the change record so a tidy-looking list does not hide unintended sharing.\nVerification\nCreate parent and child test collections with different synthetic items and access groups. Confirm that access to the parent alone does not reveal the child’s items. Add the intended child assignment and retest. Review effective permissions through every relevant group and individual assignment before applying the structure to production data.\nOfficial reference\nBitwarden — Collections. Reviewed October 15, 2026.", "content_markdown": "Nesting organizes the list; it does not copy a parent collection’s access or items.\n\n## Source facts\n\nBitwarden collections group organization-owned items for sharing, and the organization can assign access to users or groups. An organization-owned item must belong to at least one collection, while its ownership stays with the organization rather than an individual user. The documentation makes a specific distinction about nested collections: nesting changes how the collection list appears in the vault filter. It does not cause the child collection to inherit its parent’s items, access, or permissions. Those assignments must be configured independently.\n\nSource: [Bitwarden — Collections](https://bitwarden.com/help/about-collections/).\n\n## Applicability\n\nThis concerns Bitwarden organization collections and their visual nesting. Personal-vault folders, group membership, and organization administrative roles are separate concepts with different effects.\n\n## DSE recommendation\n\nDSE recommends maintaining a collection-to-group access table independent of the visual hierarchy. When creating a nested collection, review its explicit permissions and intended items instead of assuming the parent establishes a boundary. Use names that help users find information without implying inheritance that does not exist. During a restructure, check both old and new assignments before moving sensitive items. Keep organization ownership and collection access visible in the change record so a tidy-looking list does not hide unintended sharing.\n\n## Verification\n\nCreate parent and child test collections with different synthetic items and access groups. Confirm that access to the parent alone does not reveal the child’s items. Add the intended child assignment and retest. Review effective permissions through every relevant group and individual assignment before applying the structure to production data.\n\n## Official reference\n\n[Bitwarden — Collections](https://bitwarden.com/help/about-collections/). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/bitwarden-nested-collection-no-access-inheritance/", "url": "https://update.dsesecurity.com/updates/bitwarden-nested-collection-no-access-inheritance/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/bitwarden-nested-collection-no-access-inheritance/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not infer Bitwarden collection permissions from the folder-like hierarchy", "item": "https://update.dsesecurity.com/updates/bitwarden-nested-collection-no-access-inheritance/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/bitwarden-nested-collection-no-access-inheritance/#article", "identifier": "https://update.dsesecurity.com/updates/bitwarden-nested-collection-no-access-inheritance/", "url": "https://update.dsesecurity.com/updates/bitwarden-nested-collection-no-access-inheritance/", "headline": "Do not infer Bitwarden collection permissions from the folder-like hierarchy", "description": "Nesting organizes the list; it does not copy a parent collection’s access or items.", "abstract": "Nesting organizes the list; it does not copy a parent collection’s access or items.", "articleBody": "Nesting organizes the list; it does not copy a parent collection’s access or items.\nSource facts\nBitwarden collections group organization-owned items for sharing, and the organization can assign access to users or groups. An organization-owned item must belong to at least one collection, while its ownership stays with the organization rather than an individual user. The documentation makes a specific distinction about nested collections: nesting changes how the collection list appears in the vault filter. It does not cause the child collection to inherit its parent’s items, access, or permissions. Those assignments must be configured independently.\nSource: Bitwarden — Collections.\nApplicability\nThis concerns Bitwarden organization collections and their visual nesting. Personal-vault folders, group membership, and organization administrative roles are separate concepts with different effects.\nDSE recommendation\nDSE recommends maintaining a collection-to-group access table independent of the visual hierarchy. When creating a nested collection, review its explicit permissions and intended items instead of assuming the parent establishes a boundary. Use names that help users find information without implying inheritance that does not exist. During a restructure, check both old and new assignments before moving sensitive items. Keep organization ownership and collection access visible in the change record so a tidy-looking list does not hide unintended sharing.\nVerification\nCreate parent and child test collections with different synthetic items and access groups. Confirm that access to the parent alone does not reveal the child’s items. Add the intended child assignment and retest. Review effective permissions through every relevant group and individual assignment before applying the structure to production data.\nOfficial reference\nBitwarden — Collections. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:33:49+00:00", "dateModified": "2026-10-15T13:36:17+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/bitwarden-nested-collection-no-access-inheritance/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/bitwarden-nested-collection-no-access-inheritance/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not infer Bitwarden collection permissions from the folder-like hierarchy" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 264, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Bitwarden — Collections", "url": "https://bitwarden.com/help/about-collections/" } } ] } }