CVE-2026-57521 describes a broken access control vulnerability in Bitwarden Server before version 2026.5.0. Authenticated users can supply arbitrary organization IDs to the PreviewInvoiceController endpoints and bypass membership or authorization checks due to the absence of the ManageOrganizationBillingRequirement. This allows unauthorized retrieval of Stripe-computed tax totals, subscription statuses, and billing details tied to any organization's real customer and subscription data. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker with valid authentication can access sensitive billing information of any organization by exploiting missing authorization controls. This exposure includes financial details such as tax totals and subscription statuses, potentially leading to privacy violations and unauthorized disclosure of customer billing data. There is no indication of privilege escalation or code execution, but the confidentiality of billing data is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user permissions to minimize exposure and monitor for suspicious access patterns to billing endpoints. Avoid sharing organization IDs unnecessarily and apply principle of least privilege to user roles.