CVE-2026-57521

Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target organization's real customer and subscription data.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/bitwarden/server/commit/0a3d9f9deb7d407503207b0d0ca8f0165a890bee	Patch
https://github.com/bitwarden/server/pull/7583	Issue Tracking
https://github.com/bitwarden/server/releases/tag/v2026.5.0	Release Notes
https://sanjokkarki.com.np/blog/bitwarden-preview-invoice-idor	Exploit Patch Third Party Advisory
https://www.vulncheck.com/advisories/bitwarden-server-broken-access-control-via-previewinvoicecontroller	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bitwarden:server:*:*:*:*:*:*:*:*

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Bitwarden Server anterior a 2026.5.0 contiene una vulnerabilidad de control de acceso roto que permite a cualquier usuario autenticado acceder a datos de facturación de organización arbitrarios al proporcionar un organizationId arbitrario a los endpoints de PreviewInvoiceController sin comprobaciones de membresía o autorización. Los atacantes pueden explotar el ManageOrganizationBillingRequirement faltante en los endpoints de vista previa de factura para recuperar los totales de impuestos calculados por Stripe, el estado de la suscripción y los detalles de facturación derivados de los datos reales de clientes y suscripciones de cualquier organización objetivo.

Information

Published : 2026-06-25 20:17

Updated : 2026-10-25 22:10

NVD link : CVE-2026-57521

Mitre link : CVE-2026-57521

CVE.ORG link : CVE-2026-57521

JSON object : View

Products Affected

bitwarden

server

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-57521", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57521", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T13:21:03.930162Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/bitwarden/server", "vendor": "bitwarden", "product": "server", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.5.0", "versionType": "semver"}], "packageURL": "pkg:github/bitwarden/server", "defaultStatus": "affected"}]}], "published": "2026-06-25T20:17:17.220", "references": [{"url": "https://github.com/bitwarden/server/commit/0a3d9f9deb7d407503207b0d0ca8f0165a890bee", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/bitwarden/server/pull/7583", "tags": ["Issue Tracking"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/bitwarden/server/releases/tag/v2026.5.0", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://sanjokkarki.com.np/blog/bitwarden-preview-invoice-idor", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/bitwarden-server-broken-access-control-via-previewinvoicecontroller", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target organization's real customer and subscription data."}, {"lang": "es", "value": "Bitwarden Server anterior a 2026.5.0 contiene una vulnerabilidad de control de acceso roto que permite a cualquier usuario autenticado acceder a datos de facturaci\u00f3n de organizaci\u00f3n arbitrarios al proporcionar un organizationId arbitrario a los endpoints de PreviewInvoiceController sin comprobaciones de membres\u00eda o autorizaci\u00f3n. Los atacantes pueden explotar el ManageOrganizationBillingRequirement faltante en los endpoints de vista previa de factura para recuperar los totales de impuestos calculados por Stripe, el estado de la suscripci\u00f3n y los detalles de facturaci\u00f3n derivados de los datos reales de clientes y suscripciones de cualquier organizaci\u00f3n objetivo."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bitwarden:server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C860621-6544-4F8A-B634-9B5D9B5259B4", "versionEndExcluding": "2026.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}