CVE-2026-57521 json
Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController
published 4mo ago modified 3d ago also EUVD-2026-39542
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target organization's real customer and subscription data.
Patch / fix
- bitwarden server 2026.5.0
Is CVE-2026-57521 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4mo ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- sanjokkarki.com.np https://sanjokkarki.com.np/blog/bitwarden-preview-invoice-idor referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- bitwarden server
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/bitwarden/server/pull/7583
issue-tracking, patch
-
github.com
/bitwarden/server/commit/0a3d9f9deb7d407503207b0d0ca8f0165a890bee
patch
-
sanjokkarki.com.np
/blog/bitwarden-preview-invoice-idor
technical-description, exploit, patch, third-party-advisory
-
github.com
/bitwarden/server/releases/tag/v2026.5.0
release-notes
-
vulncheck.com
/advisories/bitwarden-server-broken-access-control-via-previewinvoicecontroller
third-party-advisory
Sources
- CVE List CVE-2026-57521
- NVD CVE-2026-57521
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.