Skip to content
OpenAdvisories
Medium WID-SEC-2026-2095 3 CVEs

Bitwarden: Mehrere Schwachstellen

Published Jun 25, 2026 · Updated Jun 25, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Bitwarden ausnutzen, um Daten zu manipulieren oder Informationen offenzulegen.

Product

Bitwarden ist eine Open-Source-Lösung für die Passwortverwaltung.

Vulnerabilities 3

  • High 7.1
    CVE-2026-57520

    Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint

    Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remov…

    bitwarden server
  • Medium 4.3
    CVE-2026-57521

    Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController

    Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without members…

    bitwarden server
  • Low 3.5
    CVE-2026-57522

    Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates

    Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an e…

    bitwarden server

Revision history

  1. #1

    Initiale Fassung

References