PatchTheCVECVE-2026-57521: Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated
CVE-2026-57521 is a medium-severity flaw (CVSS 4.3) affecting server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription statu
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 63%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2026-06-25 |
| Last modified | 2026-10-25 |
Last updated 2026-10-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-57521?
server: upgrade to 2026.5.0. Exact commands for each OS are on this page.
Is CVE-2026-57521 being exploited?
CVE-2026-57521 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-57521 affect?
CVE-2026-57521 affects server. Severity is medium (CVSS 4.3). Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoi
How urgent is CVE-2026-57521?
Priority 29/100. Public exploit reference
Software pages
Related CVEs
- CVE-2026-57520 HIGH 7.1 UPGRADE Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custo
- CVE-2026-57522 LOW 3.5 UPGRADE Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.Repla
- CVE-2026-15053 HIGH 7.5 UPGRADE Tanium addressed a denial of service vulnerability in Tanium Server.
- CVE-2026-60104 HIGH 8.7 UPGRADE Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body be
- CVE-2026-11925 LOW 2.7 UPGRADE Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Serve