Skip to main content

Bitwarden Server CVE-2026-57521

| EUVDEUVD-2026-39542 MEDIUM
Missing Authorization (CWE-862)
2026-06-25 VulnCheck GHSA-3pr2-gvgh-h5qc
Authentication Bypass Server
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network-reachable IDOR requiring only a valid session (PR:L); no integrity or availability impact; confidentiality limited to billing metadata, not vault data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Jun 25, 2026 - 20:20 vuln.today
Analysis Generated
Jun 25, 2026 - 20:20 vuln.today

DescriptionCVE.org

Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target organization's real customer and subscription data.

AnalysisAI

Broken access control in Bitwarden Server before 2026.5.0 exposes organization billing data to any authenticated user via an IDOR vulnerability in the PreviewInvoiceController endpoints. The missing ManageOrganizationBillingRequirement authorization check permits a valid session holder to supply an arbitrary organizationId and retrieve Stripe-derived billing details - including tax totals, subscription status, and customer data - for organizations they do not belong to. A public proof-of-concept exploit exists; no active exploitation has been confirmed by CISA KEV at the time of analysis.

Technical ContextAI

Bitwarden Server is the self-hosted and cloud-deployed backend for the Bitwarden password management platform, identified by CPE cpe:2.3:a:bitwarden:server:*:*:*:*:*:*:*:*. The vulnerable component is the PreviewInvoiceController, an API endpoint group that generates invoice previews by querying Stripe (the payment processor) using organization-specific customer and subscription identifiers. The root cause is CWE-862 (Missing Authorization): the controller accepts a caller-supplied organizationId parameter but performs no membership or permission check - specifically, the ManageOrganizationBillingRequirement policy is absent. This constitutes an Insecure Direct Object Reference (IDOR) pattern. Because organizationId values are used directly to proxy Stripe API calls, any valid session token is sufficient to extract billing metadata for any organization hosted on the same Bitwarden Server instance.

RemediationAI

Upgrade Bitwarden Server to version 2026.5.0 or later, available at https://github.com/bitwarden/server/releases/tag/v2026.5.0. The underlying fix - adding ManageOrganizationBillingRequirement to the PreviewInvoiceController endpoints - is implemented in PR #7583 and commit 0a3d9f9deb7d407503207b0d0ca8f0165a890bee. Operators who cannot immediately upgrade should consider restricting network-level access to the billing API endpoints at the reverse proxy or firewall layer, ensuring only organization administrators' IP ranges can reach PreviewInvoiceController routes; note this trade-off may disrupt legitimate invoice preview workflows for end users. There are no known configuration-level workarounds that replicate the missing authorization check without upgrading.

More in Server

View all
CVE-2018-1000881 CRITICAL POC
9.8 Dec 20

Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
CVE-2026-60104 CRITICAL POC
9.3 Jul 08

Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
CVE-2026-43639 HIGH POC
8.9 May 11

Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
CVE-2021-42973 HIGH POC
8.8 Dec 07

NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
CVE-2021-42972 HIGH POC
8.8 Dec 07

NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
CVE-2026-43640 HIGH POC
8.6 May 11

Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
CVE-2019-25609 HIGH POC
8.6 Mar 22

JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
CVE-2023-30223 HIGH POC
7.5 Jun 16

A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
CVE-2023-30222 HIGH POC
7.5 Jun 16

An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
CVE-2026-57520 HIGH POC
7.1 Jun 25

Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
CVE-2026-71959 MEDIUM POC
6.9 Aug 10

Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
CVE-2017-7855 MEDIUM POC
6.1 Aug 31

In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate

Share

CVE-2026-57521 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy