Bitwarden Unprivileged User Privilege Escalation to Remove Admins via Bulk Remove Endpoint (CVE-2026-57520)

Vulnerability Overview Bitwarden’s Custom Users can remove Administrators via the Bulk-Remove Endpoint. This vulnerability arises because the role-level protection present in the Single-User Remove Path was not replicated in the Bulk-Remove Path. Affected Scope Vendor: Bitwarden Product: bitwarden/server Severity: High (CVSS 7.1) CVE: CVE-2026-57520 Report: HackerOne #3673748 Fix: PR #7526 - commit '901bb671' Fixed Version: server release '2026.5.0' (2026-05-29) Remediation The fix involves adding the same role-level check present in the Single-User Remove Path ( ) to the Bulk-Remove Path ( ). The specific fix code is as follows: POC Code An attacker can exploit this vulnerability through the following steps: 1. The attacker is a Custom User with only the permission. 2. List members via and retrieve the Organization User IDs of Administrators. 3. Single-user removal is correctly denied: 4. Bulk removal succeeds: An HTTP 200 status with an empty "error" field indicates that the Administrator has been removed. Disclosure Timeline 2026-04-14: Reported to HackerOne (#3673748), including source code analysis and live PoC. 2026-04-16: Triaged; severity adjusted to final High 7.1; routed to Engineering/Product. 2026-04-23: Fix merged into main: PR #7526, commit 901bb671. 2026-05-29: Fix released in server version 2026.5.0. 2026-06-23: Resolved and bounty awarded. Vendor confirmed that the same protection was applied to the revoke and restore endpoints. Lessons Learned Authorization checks do not automatically apply when adding a "bulk execution" handler for existing functionality. Every check item in the Single-User path should serve as a checklist for the Bulk Path. Perform a line-by-line comparison of both. Patching one entry point does not constitute a complete fix for the vulnerability. PR #5590 fixed the Single-User Remove path in 2025, but the Bulk Path remained open for over a year. Whenever a role-level check exists, identify all operations that should share it. Thanks to @mandreko-bitwarden and the Bitwarden Security Team for the swift response and fix. @thesanjok

Goal Reached Thanks to every supporter — we hit 100%!

Bitwarden Unprivileged User Privilege Escalation to Remove Admins via Bulk Remove Endpoint (CVE-2026-57520)