Описание
Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal path, effectively removing one or more Admin accounts from an organization.
Ссылки
- Patch
- Issue Tracking
- Release Notes
- ExploitPatchThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
EPSS
7.1 High
CVSS3
Дефекты
Связанные уязвимости
Bitwarden Server before 2026.5.0 contains a privilege escalation vulne ...
Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal path, effectively removing one or more Admin accounts from an organization.
EPSS
7.1 High
CVSS3