CVE-2026-71959 describes a missing authorization check in Bitwarden Server prior to version 2026.7.2. Specifically, the server fails to confirm that the authenticated user making a POST /collect request belongs to the organization identified in the request body. This authorization bypass enables an authenticated user to write falsified audit log entries, including entries with arbitrary backdating, into any organization's audit log. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. There is no explicit vendor advisory or patch link provided, and the remediation level is not stated.

An attacker with valid authentication credentials on the Bitwarden Server can manipulate audit logs of any organization by injecting forged and backdated entries. This undermines the integrity and reliability of audit logs, potentially obscuring malicious activity or causing confusion in forensic investigations. There is no indication that this vulnerability allows privilege escalation or unauthorized data access beyond log manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to 2026.7.2, upgrading to version 2026.7.2 or later is likely to address the issue once an official fix is released. Until then, restrict authenticated user permissions and monitor audit log integrity where possible.