CVE-2026-57521

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57521
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57521.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57521
Published
2026-06-25T19:09:08.990Z
Modified
2026-07-16T03:30:58.426060224Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController
Details

Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target organization's real customer and subscription data.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57521.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/bitwarden/server

Affected ranges

Type
GIT
Repo
https://github.com/bitwarden/server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c3cabffccfe35004f5022f91f95cc0fb5e8aa7c4
Fixed
0a3d9f9deb7d407503207b0d0ca8f0165a890bee
Database specific 
{
    "cpe": "cpe:2.3:a:bitwarden:server:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026.5.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.22.0
1.4.0
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.10.0
v1.11.0
v1.11.1
v1.12.0
v1.12.1
v1.13.0
v1.13.1
v1.14.0
v1.14.1
v1.14.2
v1.15.0
v1.15.1
v1.16.0
v1.17.0
v1.17.1
v1.17.2
v1.18.0
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.30.0
v1.30.1
v1.30.2
v1.30.3
v1.30.4
v1.31.0
v1.31.1
v1.32.0
v1.33.0
v1.33.1
v1.34.0
v1.35.0
v1.35.1
v1.36.0
v1.36.1
v1.37.0
v1.37.1
v1.37.2
v1.38.0
v1.38.1
v1.38.2
v1.39.0
v1.4.1
v1.5.0
v1.5.1
v1.6.0
v1.7.0
v1.8.0
v1.8.1
v1.8.2
v1.9.0
v2024.*
v2024.1.2
v2024.10.1
v2024.2.3
v2024.5.0
v2024.8.0
v2024.8.1
v2025.*
v2025.10.1
v2025.7.1
v2025.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57521.json"