CVE-2026-57520

HighCVSS 7.1/10Last modified Oct 25, 2026

Description

Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal path, effectively removing one or more Admin accounts from an organization.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
bitwarden	server	< 2026.5.0

References

https://github.com/bitwarden/server/commit/901bb67157c0f80d369c40b76742fdf7623da4e4Patch
https://github.com/bitwarden/server/pull/7526Issue Tracking
https://github.com/bitwarden/server/releases/tag/v2026.5.0Release Notes
https://sanjokkarki.com.np/blog/bitwarden-bulk-remove-adminExploit, Patch, Third Party Advisory
https://www.vulncheck.com/advisories/bitwarden-server-privilege-escalation-via-bulk-user-remove-endpointThird Party Advisory

Timeline

Published: Jun 25, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-575214.3Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organ CVE-2026-575225.0Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes CVE-2026-575278.8Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who contro CVE-2026-57536.5The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including CVE-2026-575305.4Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components pack CVE-2026-575315.4Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated a CVE-2026-575328.8Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in CVE-2026-575332.1Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Co CVE-2026-575342.1Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.CVE-2026-575352.1Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these CVE-2026-575366.3Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status CVE-2026-575377.8Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.