CVE-2026-71959

Medium

Description

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.

SeverityMedium

CVSS5.8

Exploit probability—

ProductBitwarden Server

PublishedAug 10, 2026

First seenAug 10, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

bitwarden server2026.7.2 or later

Patches

github.com/bitwarden/server/commit/2aa92a3c8675a28e305e8207ff16592227f96291

Vendor advisories

github.com/bitwarden/server/releases/tag/v2026.7.2

Affected products

Product	Affected versions	Fixed in
bitwarden server	v < 2026.7.2	2026.7.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.