CVE-2026-57521

MediumCVSS 4.3/10Last modified Oct 25, 2026

Description

Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target organization's real customer and subscription data.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-575225.0Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes CVE-2026-575278.8Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who contro CVE-2026-57536.5The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including CVE-2026-575305.4Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components pack CVE-2026-575315.4Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated a CVE-2026-575328.8Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in CVE-2026-575332.1Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Co CVE-2026-575342.1Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.CVE-2026-575352.1Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these CVE-2026-575366.3Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status CVE-2026-575377.8Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.CVE-2026-57546.1Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scri