Bitwarden Server CVE-2026-57521

The attacker must possess a valid authenticated session on the target Bitwarden Server instance (PR:L); unauthenticated exploitation is not possible. The attacker must know or enumerate valid organizationId values for target organizations hosted on the same server instance. No organization membership, administrator role, or billing permission is required - the flaw specifically bypasses the ManageOrganizationBillingRequirement that should gate these endpoints. The vulnerability is limited to instances where the PreviewInvoiceController billing endpoints are reachable and where organizations have active Stripe subscriptions (necessary for the Stripe proxy call to return meaningful data). Self-hosted deployments not integrated with Stripe billing would yield no useful data even if the endpoint is reached.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) establishes a baseline score of 5.3, reflecting network reachability with low privilege requirements and limited confidentiality impact. The attack requires an authenticated session (PR:L), which meaningfully constrains the attacker pool to existing registered users of the Bitwarden instance - reducing risk relative to a fully unauthenticated flaw. No EPSS data was provided in the intelligence package; however, the availability of a public POC blog post (sanjokkarki.com.np) and formal VulnCheck advisory increases the likelihood of exploitation attempts against unpatched deployments. The absence of CISA KEV listing suggests no confirmed widespread active exploitation at time of analysis. Impact is limited to confidentiality of billing metadata (Stripe tax totals, subscription tier, payment status) and does not reach vault contents, credentials, or authentication material - an important scoping distinction for a password manager. For cloud-managed Bitwarden deployments, Bitwarden would have patched server-side infrastructure; residual risk is concentrated in self-hosted Bitwarden Server operators who have not yet upgraded to 2026.5.0.

An attacker holding any valid authenticated session on a self-hosted Bitwarden Server instance - such as a personal account with no organizational affiliation - sends crafted HTTP requests to the PreviewInvoiceController endpoints, substituting the organizationId parameter with identifiers belonging to other organizations on the same server. Because no membership or billing permission check is enforced, the server proxies the request to Stripe and returns subscription status, tax data, and billing details for the target organization. A public proof-of-concept demonstrating this technique is available at https://sanjokkarki.com.np/blog/bitwarden-preview-invoice-idor.