CVE-2026-57521: Broken Access Control in Bitwarden Server Billing API (Pre-2026.5.0)

Technical summary

CVE-2026-57521 is a broken access control vulnerability (CWE-862) affecting the PreviewInvoiceController endpoints in Bitwarden Server. The vulnerability stems from the absence of ManageOrganizationBillingRequirement authorization checks. An authenticated attacker can supply an arbitrary organizationId parameter without membership verification, enabling unauthorized disclosure of Stripe-derived billing metadata, tax totals, subscription details, and customer data tied to target organizations. The vulnerability requires valid authentication (PR:L) and results in low confidentiality impact (C:L) with no integrity or availability consequences.

Business impact

Organizations running affected Bitwarden Server instances face exposure of confidential financial and subscription information. Attackers with valid credentials—including lower-privileged users, departing employees, or compromised accounts—can enumerate and access billing details across all organizations on the server without administrative role restrictions. This creates compliance risk around financial data handling, potential competitive intelligence leakage if billing volumes or customer counts are exposed, and reputational damage if this vulnerability is exploited to access sensitive customer information. The breach is limited to read-only disclosure but affects the entire financial audit trail and subscription portfolio.

Affected systems

Bitwarden Server versions prior to 2026.5.0 are vulnerable. This affects on-premises and self-hosted Bitwarden Server deployments. Cloud-hosted Bitwarden.com users should verify whether they run the affected version through their account settings or vendor notification. Any organization relying on network-isolated or air-gapped Bitwarden Server instances should assume exposure if running pre-2026.5.0 builds. Multi-tenant deployments are at heightened risk due to the cross-organization access scope.

Exploitability

Exploitation requires valid user credentials (authenticated access), making it suitable for insider threats, compromised accounts, or supply-chain attack scenarios. Once authenticated, the attack is trivial—an attacker needs only to craft HTTP requests to PreviewInvoiceController endpoints with different organizationId values, requiring no special tools or user interaction. The low network barrier and straightforward parameter manipulation make this attractive to operators with internal network access or accounts obtained through phishing or credential compromise. However, public exploitation is unlikely without valid credentials, keeping real-world risk moderate unless account compromise occurs first.

Remediation

Upgrade Bitwarden Server to version 2026.5.0 or later. This release includes authorization checks (ManageOrganizationBillingRequirement) on the affected PreviewInvoiceController endpoints, restricting access to authenticated users with explicit billing management permissions on the target organization. Verify the patch version in your deployment and plan upgrades promptly for production systems. Organizations unable to upgrade immediately should review access logs for suspicious PreviewInvoiceController queries and consider network-level segmentation to limit access to the Bitwarden Server API.

Patch guidance

Update Bitwarden Server to version 2026.5.0 or higher. Review your deployment method (Docker, VM, Kubernetes) and follow Bitwarden's official upgrade documentation to ensure zero-downtime or minimal downtime patching. Test the upgrade in a non-production environment first, particularly if you have custom integrations or organizational sync policies. Post-upgrade, validate that the PreviewInvoiceController endpoints now correctly enforce organization membership checks by attempting to access another organization's invoice preview—this should fail with a 403 Forbidden response if the patch is applied correctly.

Detection guidance

Monitor authentication logs and API access patterns for unusual PreviewInvoiceController requests, particularly from low-privileged users or service accounts accessing multiple organizationId values in sequence. Implement WAF or API gateway rules to log and alert on PreviewInvoiceController calls lacking a matching organizationId in the user's membership list. Query audit logs for invoice preview actions across organizations; legitimate use should occur only within the user's own organization. If you suspect exploitation, export Bitwarden's API logs (available in server logs) and search for PreviewInvoiceController endpoints called with organizationId parameters that do not correspond to the requester's enrolled organizations.

Why prioritize this

While the CVSS score of 4.3 (Medium) reflects limited technical impact (read-only disclosure, low severity), the business risk is material. Billing data is highly sensitive, subject to regulatory scrutiny, and often targets for competitive or malicious intelligence gathering. The low barrier to exploitation—needing only valid credentials and parameter manipulation—combined with the cross-tenant exposure in multi-organization deployments elevates practical risk. Organizations with strict data governance policies or those in regulated industries (finance, healthcare, legal) should prioritize this patch within 30 days; others within 60 days.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a Medium severity rating: attack vector network (AV:N), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and scope unchanged (S:U) yield a base score of 4.3. Confidentiality impact is low (C:L) because billing data, while sensitive, does not directly expose authentication credentials, personal identity, or operational secrets. Integrity (I:N) and availability (A:N) are not impacted. However, real-world business risk may exceed the numerical score due to regulatory and competitive intelligence concerns; use CVSS as a baseline, not a ceiling.

Frequently asked questions