| Package | Affected versions | Patched versions |
|---|---|---|
| server | < 2026.5.0 | 2026.5.0 |
Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal path, effectively removing one or more Admin accounts from an organization.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free