Which versions of Bitwarden Server are affected by CVE-2026-57520?

Self-hosted Bitwarden deployments before version 2026.5.0 allow non-administrator users with specific role permissions to remove administrator accounts, eliminating security oversight and control.. A patch is available.

Is there a public PoC exploit available for CVE-2026-57520?

Yes, a public proof-of-concept exploit is available for CVE-2026-57520. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-57520?

Within 24 hours: Audit all organization members with Custom roles holding the ManageUsers permission and assess exposure. Within 7 days: Upgrade all Bitwarden Server instances to version 2026.5.0 or later and verify all administrator accounts remain intact post-upgrade. Within 30 days: Review and refine Custom role definitions and permissions to enforce principle of least privilege across the organization.

Bitwarden Server CVE-2026-57520

Q: What is the CVSS score of CVE-2026-57520?

CVE-2026-57520 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39541 HIGH

Missing Authorization (CWE-862)

2026-06-25 VulnCheck

GHSA-6f6g-3qf9-xqc4

Authentication Bypass Privilege Escalation Server

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network endpoint with low complexity but requires an existing ManageUsers-granted account (PR:L); impact is integrity-high from removing Admins with low availability and no confidentiality effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 25, 2026 - 20:20 vuln.today

Analysis Generated

Jun 25, 2026 - 20:20 vuln.today

DescriptionCVE.org

Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal path, effectively removing one or more Admin accounts from an organization.

AnalysisAI

Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a Custom role with the ManageUsers permission delete Admin accounts from the organization, undermining administrative control. The flaw stems from the bulk user-remove (DELETE) endpoint omitting the role-hierarchy guard that the single-user removal path enforces, so a lower-privileged user can strip Admins by submitting their organization-user IDs in a batch request. Publicly available exploit code exists (VulnCheck/researcher write-up), it is not listed in CISA KEV, and no EPSS score was provided in the input.

Technical ContextAI

Bitwarden Server is the self-hostable backend for the Bitwarden password-management platform, exposing REST endpoints that manage organizations and their members under a role model (Owner > Admin > Custom/User). The vulnerability is classified CWE-862 (Missing Authorization): the single-user removal path validates that the caller is permitted to act on the target's role tier, but the parallel bulk-removal endpoint that accepts an array of organization-user IDs in a DELETE request fails to apply the same role-hierarchy check. The affected component is identified by CPE cpe:2.3:a:bitwarden:server:*, with the corrective change merged in pull request #7526 (commit 901bb67) and shipped in tag v2026.5.0.

RemediationAI

Vendor-released patch: upgrade Bitwarden Server to 2026.5.0 or later (release: https://github.com/bitwarden/server/releases/tag/v2026.5.0), which adds the missing role-hierarchy check to the bulk user-remove endpoint. Until the upgrade is applied, reduce exposure by auditing and minimizing which members hold Custom roles with the ManageUsers permission - revoke or downgrade non-essential delegated user-managers, since this permission is the sole precondition for exploitation; the trade-off is that legitimate delegated user administration is curtailed while the restriction is in place. Additionally, enable and monitor organization event logs for unexpected bulk member-removal events targeting Admin/Owner accounts so any abuse is detected and can be reversed quickly. Reference the fix details in PR https://github.com/bitwarden/server/pull/7526 and the VulnCheck advisory https://www.vulncheck.com/advisories/bitwarden-server-privilege-escalation-via-bulk-user-remove-endpoint.