CVE-2026-71959
Received Received - Intake

Bitwarden Server Audit Log Forgery Vulnerability

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-71959
EUVD
EUVD-2026-55631

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bitwarden server to 2026.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Bitwarden Server before 2026.7.2 allows any authenticated user to write forged audit log entries for any organization by sending a POST /collect request without verifying organization membership. This enables backdating arbitrary entries in audit logs.

Impact Analysis

An attacker could manipulate audit logs to hide malicious activity, frame innocent users, or create false evidence of compliance. This undermines trust in audit trails and could lead to undetected security breaches or compliance violations.

Compliance Impact

This vulnerability could violate requirements for tamper-proof audit logs in GDPR (data integrity) and HIPAA (audit controls). Forged logs may fail compliance audits and expose organizations to legal or regulatory penalties.

Mitigation Strategies

Update Bitwarden Server to version 2026.7.2 or later to address the vulnerability. Review audit logs for unauthorized entries and restrict access to sensitive organization data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71959. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart