CVE-2026-57520

Katalog CVE

CVSS 7.1 · High EPSS 0,64%

Kerentanan Missing Authorization pada bitwarden server. Skor CVSS 3.1 7.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal path, effectively removing one or more Admin accounts from an organization.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bitwarden/server/commit/901bb67157c0f80d369c40b76742fdf7623da4e4 patch
• https://sanjokkarki.com.np/blog/bitwarden-bulk-remove-admin exploit · patch · advisory pihak ketiga
• https://www.vulncheck.com/advisories/bitwarden-server-privilege-escalation-via-bulk-user-remove-endpoint advisory pihak ketiga
• https://github.com/bitwarden/server/pull/7526 issue tracking
• https://github.com/bitwarden/server/releases/tag/v2026.5.0 release notes