Description
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| bitwarden | server | < 2026.7.2 | 2026.7.2 |
Advisories 1
- WID-SEC-2026-2737 Bitwarden: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Aug 10, 2026
References
- Researcher Blog technical-description exploit
- server 2026.7.2 Release Notes release-notes
- Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/bitwarden-server-audit-log-injection-via-post-collect third-party-advisory