Bitwarden Server CVE-2026-57520

Exploitation requires an authenticated organization member assigned a Custom role that includes the ManageUsers permission (PR:L) on a self-hosted Bitwarden Server older than 2026.5.0; the attacker must target the bulk user-remove DELETE endpoint and supply the organization-user IDs of Admin accounts, exploiting the absence of the role-hierarchy check that the single-user removal path enforces. No user interaction and no special non-default feature toggle are needed beyond an org configured with at least one Custom-role user holding ManageUsers. Limiting factors: the attacker cannot be fully unauthenticated or an arbitrary low-privilege user - the ManageUsers grant is mandatory - and impact is restricted to organizational administration integrity (removing Admins), not reading or decrypting vault secrets.

Signals are moderately consistent and point to a real but bounded authorization risk rather than a mass-exploitation emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L) scores 7.1 (High): network reachable, low complexity, but requiring existing privileged access (PR:L - a Custom user already granted ManageUsers), with impact concentrated on integrity (VI:H, removal of admins) and limited availability (VA:L) and no confidentiality impact (VC:N) - the attacker cannot read vault data, only disrupt organization administration. Public exploit code exists, which raises practical likelihood, but the CVE is not in CISA KEV and no EPSS value was supplied, so there is no evidence of widespread automated exploitation; the PR:L precondition makes this a privileged-insider / compromised-delegated-admin scenario rather than an unauthenticated internet threat. Note a possible tension worth verifying: the SSVC/technical framing implies integrity-only impact, yet removing all Admins/Owners could in practice deny legitimate administration - confirm with the vendor whether last-Owner protections still apply.

An organization grants a team lead a Custom role with the ManageUsers permission so they can onboard staff; that account (or an attacker who phishes it) sends a single bulk DELETE request to the user-remove endpoint containing the organization-user IDs of the org's Admins. Because the bulk path skips the role-hierarchy guard, the Admins are removed, leaving the organization without higher-tier oversight. A public proof-of-concept and write-up for this exact bypass are available, lowering the skill barrier for exploitation.