Bitwarden Server versions prior to 2026.5.0 allow an authenticated Custom user who has the ManageUsers permission to remove one or more Admin accounts from an organization. The vulnerability is caused by a missing role hierarchy validation in the bulk user‑remove endpoint, a Role Control weakness identified as CWE‑862, allowing the attacker to supply Admin organization‑user IDs in a bulk DELETE request and bypass the guard that is enforced on the single‑user path. The result is that Admin accounts are effectively removed, reducing the overall authority within the organization and potentially disabling critical administrative functions.

The affected product is Bitwarden Server. All releases before 2026.5.0 are impacted. No specific sub‑versions are enumerated beyond the stated cutoff.

The CVSS score of 7.1 indicates a high‑severity risk. The exploit requires the attacker to be an authenticated user with ManageUsers permission, so an attacker with such credentials can perform the privilege escalation. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Therefore, while exploitation is possible, its likelihood depends on user privilege assignments and internal security measures.