CVE-2026-57521

Katalog CVE

CVSS 4.3 · Medium EPSS 0,43%

Kerentanan Missing Authorization pada bitwarden server. Skor CVSS 3.1 4.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target organization's real customer and subscription data.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bitwarden/server/commit/0a3d9f9deb7d407503207b0d0ca8f0165a890bee patch
• https://sanjokkarki.com.np/blog/bitwarden-preview-invoice-idor exploit · patch · advisory pihak ketiga
• https://www.vulncheck.com/advisories/bitwarden-server-broken-access-control-via-previewinvoicecontroller advisory pihak ketiga
• https://github.com/bitwarden/server/pull/7583 issue tracking
• https://github.com/bitwarden/server/releases/tag/v2026.5.0 release notes