PT-2026-52574

CVE-2026-57520

Published

2026-06-25

Updated

2026-06-27

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Bitwarden Server versions prior to 2026.5.0

Description An issue exists where authenticated Custom users with the ManageUsers permission can escalate privileges to remove Admin accounts from an organization. This occurs due to a missing role hierarchy check in the bulk user-remove endpoint. By supplying Admin organization-user IDs in a bulk DELETE request, an attacker can bypass the security guards present in the single-user removal path.

Recommendations Update Bitwarden Server to version 2026.5.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Sanjok Karki

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers