Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: bitwarden server 2026.5.0 Clear all filters
TI-2026-41412 CVE-2026-57522 · GHSA-w6hw-45mp-qr7v

Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates

Priority MEDIUM 45

Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00455 Published 2026-06-25 Fixed in 2026.5.0 CWE-74
TI-2026-41411 CVE-2026-57521 · GHSA-3pr2-gvgh-h5qc

Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController

Priority MEDIUM 57

Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvo…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0043 Published 2026-06-25 Fixed in 2026.5.0 CWE-862
TI-2026-41410 CVE-2026-57520 · GHSA-6f6g-3qf9-xqc4

Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint

Priority MEDIUM 64

Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00639 Published 2026-06-25 Fixed in 2026.5.0 CWE-862