CVE-2026-71959
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.
Risk Assessment
Risk of compromising audit log integrity, which could hide unauthorized actions and hinder security incident detection.
Recommendation
It is recommended to update immediately to version 2026.7.2 or later, which includes the fix.
Original NVD description (English source)
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.