CVE-2026-57520: Bitwarden Server privilege escalation in bulk user removal endpoint

CVE-2026-57520 · Severity: high · CVSS 7.1 · Published 2026-06-25

Executive brief

Bitwarden Server, the backend for the popular password management platform, contained a flaw that allowed certain lower-privileged users to remove administrators from an organization. Specifically, users with 'Custom' permissions and the ability to manage users could bypass security restrictions by using a 'bulk delete' feature instead of the standard single-user removal tool. This could allow an attacker to disrupt organization management or lock out legitimate administrators, potentially leading to a loss of administrative control over the password vault.

Technical details

A privilege escalation vulnerability exists in Bitwarden Server due to a missing role hierarchy check in the bulk user removal endpoint (`DELETE /api/organizations/{orgId}/users`). While the single-user removal path correctly enforces a guard preventing 'Custom' users from deleting 'Admin' users, the bulk removal path (`RemoveUsersInternalAsync`) failed to implement the same check. An authenticated attacker with 'ManageUsers' permissions can obtain Admin organization-user IDs and include them in a bulk DELETE request to successfully remove one or more Admin accounts. This bypasses the intended authorization logic that restricts Custom users from affecting higher-privileged roles. The issue is fixed in version 2026.5.0 by adding the missing role validation to the bulk removal loop.

CVE-2026-57520: Bitwarden Server privilege escalation in bulk user removal endpoint

Executive brief

Technical details

Affected products

Timeline

References