VULNERABILITY INTELLIGENCE

CVE-2026-57520

CVSS score7.1 HIGH

EPSS probability0.64%

CISA KEVNot currently listed

Published2026-06-25

Last modified2026-10-25

CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Description

Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal path, effectively removing one or more Admin accounts from an organization.

Weakness classification

CWE-862: Missing Authorization

Primary references

disclosure@vulncheck.com — Patch
disclosure@vulncheck.com — Issue Tracking
disclosure@vulncheck.com — Release Notes
disclosure@vulncheck.com — Exploit, Patch, Third Party Advisory
disclosure@vulncheck.com — Third Party Advisory