# CVE-2026-57521: Bitwarden Server broken access control in PreviewInvoiceController

Source: https://junglewise.ai/threats/cve-2026-57521-bitwarden-server-broken-access-control-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-57521 · Severity: medium · CVSS 4.3 · Published 2026-06-25

Bitwarden Server is the backend infrastructure for the Bitwarden password management service. A security flaw in the server's billing component allowed any logged-in user to view sensitive financial information belonging to other organizations. An attacker could have accessed details such as subscription status, tax totals, and billing data, potentially leading to the exposure of corporate customer information and financial metadata.

## Quick answers

**Is CVE-2026-57521 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57521 being exploited in the wild.

**How severe is CVE-2026-57521?** Medium severity, with a CVSS score of 4.3, published 25 June 2026.

**Which products and versions are affected?** Bitwarden Server before 2026.5.0.

**Is there a fix for CVE-2026-57521?** A patch was published on 2026-05-05: Authorization fix committed to server repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57521 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-57521?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability (IDOR) exists in the PreviewInvoiceController endpoints of Bitwarden Server. The affected endpoints, specifically POST .../subscription/plan-change and PUT .../subscription/update, utilized the [InjectOrganization] action filter to load organization data from the route but failed to implement the ManageOrganizationBillingRequirement authorization check. This allowed any authenticated user to supply an arbitrary organizationId and retrieve Stripe-computed tax totals, subscription status, and billing details belonging to other organizations. The vulnerability was addressed in version 2026.5.0 by adding the missing [Authorize<ManageOrganizationBillingRequirement>] attribute to the affected endpoints.

## Affected products

- Bitwarden Server before 2026.5.0

## Timeline

- 2026-05-05: patched: Authorization fix committed to server repository
- 2026-05-29: advisory: Version 2026.5.0 released
- 2026-06-25: disclosed: CVE-2026-57521 published

## References

- [https://github.com/bitwarden/server/commit/0a3d9f9deb7d407503207b0d0ca8f0165a890bee](https://github.com/bitwarden/server/commit/0a3d9f9deb7d407503207b0d0ca8f0165a890bee)
- [https://github.com/bitwarden/server/pull/7583](https://github.com/bitwarden/server/pull/7583)
- [https://github.com/bitwarden/server/releases/tag/v2026.5.0](https://github.com/bitwarden/server/releases/tag/v2026.5.0)
- [https://sanjokkarki.com.np/blog/bitwarden-preview-invoice-idor](https://sanjokkarki.com.np/blog/bitwarden-preview-invoice-idor)
- [https://www.vulncheck.com/advisories/bitwarden-server-broken-access-control-via-previewinvoicecontroller](https://www.vulncheck.com/advisories/bitwarden-server-broken-access-control-via-previewinvoicecontroller)