CVE-2026-57520: Bitwarden Server Privilege Escalation – Admin Account Removal Vulnerability

Technical summary

The vulnerability exists in Bitwarden Server's bulk user-removal endpoint (bulk DELETE operation). While the single-user removal path enforces proper role hierarchy checks preventing non-admins from removing Admin accounts, the bulk removal endpoint lacks equivalent validation. An authenticated Custom user with ManageUsers permission can supply Admin organization-user IDs in a bulk DELETE request to bypass these guards and remove one or more Admin accounts. This represents a classic authorization bypass where a security control present in one code path is missing in a parallel, less-restrictive path. The issue is categorized as CWE-862 (Missing Authorization).

Business impact

Successful exploitation allows attackers to strip administrative privileges from legitimate Admin accounts, disrupting organizational governance and access control. This could enable further account takeovers, unauthorized data access, or complete organizational lockout scenarios depending on how many Admin accounts are removed. The impact extends beyond the immediate attacker—other malicious insiders or compromised accounts with ManageUsers permissions could exploit the same flaw, making this a critical control plane vulnerability for any organization relying on Bitwarden for credential management.

Affected systems

Bitwarden Server versions before 2026.5.0 are affected. The vulnerability requires an authenticated account with Custom user role and ManageUsers permission, limiting the risk surface to environments where such permissions have been granted. Self-hosted Bitwarden Server deployments and managed service instances both require the patch.

Exploitability

Exploitability is moderate-to-high in practice. The attack requires valid credentials and specific permission assignment (ManageUsers on a Custom user role), which is not a default high-privilege grant. However, once such an account exists—whether through delegation to department admins, contractor access, or compromised credentials—the actual exploit is trivial (a bulk DELETE request with Admin IDs). No complex technical sophistication is required; this is straightforward API abuse. The CVSS score of 7.1 (HIGH) reflects the local authentication requirement but acknowledges the significant integrity and availability impact.

Remediation

Update Bitwarden Server to version 2026.5.0 or later. Organizations should prioritize this patch given the direct threat to administrative access control. In addition to patching, audit current ManageUsers permission grants to Custom users—restrict this permission to only those users who genuinely need bulk user management capabilities, following least-privilege principles.

Patch guidance

Verify the current Bitwarden Server version in your deployment (typically found in the admin dashboard or server logs). Download and deploy version 2026.5.0 or later from the official Bitwarden repository or your subscription portal. Test the upgrade in a staging environment first to ensure no disruption to credential synchronization or access workflows. Standard Bitwarden update procedures apply; consult your deployment model (Docker, VM, cloud-managed) for specific steps. After patching, confirm that the bulk user-removal endpoint properly validates role hierarchy for all removed accounts.

Detection guidance

Monitor for suspicious bulk user-removal operations, particularly those targeting Admin accounts. Check audit logs for DELETE requests to the bulk user-removal endpoint that include Admin organization-user IDs, especially if initiated by Custom users. Track permission assignments—alert on any grant of ManageUsers to non-Admin Custom users that was not explicitly expected. Correlate removal events with Admin account access failures or unexpected administrative unavailability. If Bitwarden Server logs are centralized to a SIEM, write detection rules for bulk deletion operations that succeed in removing Admin accounts; these should be rare in normal operations.

Why prioritize this

While not yet listed on the CISA KEV catalog, this vulnerability should be treated as high-priority for Bitwarden deployments because it directly compromises the integrity of identity and access management controls. Any organization using Bitwarden as a credential vault or SSO provider should patch immediately to preserve administrative governance and prevent insider threats. The attack surface is narrower than a remote code execution, but the impact—loss of administrative control—justifies urgent treatment.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: network-accessible endpoint (AV:N), low attack complexity (AC:L), requirement for low-privilege authenticated access (PR:L), no user interaction (UI:N), unchanged scope (S:U). The confidentiality impact is None (C:N) because the exploit does not disclose data, but integrity (I:H) is High because Admin role removal is a direct authorization violation, and availability (A:L) is Low because organizational operations may be degraded if all Admins are removed. The score appropriately captures a significant but not critical risk in standard enterprise networks.

Frequently asked questions