Privilege Escalation Vulnerability in Bitwarden Server by Bitwarden
CVE-2026-57520

7.1HIGH

Key Information:

Vendor: Bitwarden
Status: Server
Vendor: CVE Published:; 25 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-57520?

A privilege escalation vulnerability in Bitwarden Server versions prior to 2026.5.0 allows authenticated Custom users with ManageUsers permission to exploit a lack of role hierarchy verification. This vulnerability permits an attacker to remove Admin accounts from an organization through a maliciously crafted bulk DELETE request. By bypassing the intended protections of the single-user removal endpoint, the attacker can delete one or more Admin accounts, potentially compromising the entire organization’s security framework.

Affected Version(s)

server 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-57520 - Proof of Concept