CVE-2026-57521 Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController

What is CVE-2026-57521?

CVE-2026-57521 is a medium-severity missing authorization vulnerability in bitwarden server, published on 25 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target organization's real customer and subscription data.

Weakness: CWE-862

Which versions are affected by CVE-2026-57521?

It affects 1 product.

Products include Bitwarden Server.

How do I fix CVE-2026-57521?

No fix has been published for CVE-2026-57521 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-57521 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57521 exists.

Other vulnerabilities in bitwarden server

• CVE-2026-60104 Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request Critical 9.3
• CVE-2026-43639 Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients High 8.9
• CVE-2026-43640 Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key High 8.6
• CVE-2020-15879 Server-side request forgery in n/a High 7.5
• CVE-2019-19766 Weak cryptography in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3pr2-gvgh-h5qc.