CVE-2026-71959: Bitwarden Server Auth Bypass Vulnerability

CVE-2026-71959 Overview

CVE-2026-71959 is a missing authorization vulnerability [CWE-862] in Bitwarden Server versions before 2026.7.2. The POST /collect endpoint does not verify that the caller is a member of the organization referenced in the request body. Any authenticated user can write forged, arbitrarily backdated entries into any organization's audit log. This undermines the integrity of audit trails used for compliance, incident response, and forensic investigations.

Critical Impact
Authenticated attackers can inject fabricated audit log entries into arbitrary organizations, corrupting forensic evidence and enabling repudiation of malicious activity.

Affected Products

Bitwarden Server versions before 2026.7.2
Self-hosted Bitwarden deployments running affected server versions
Bitwarden organizations relying on audit logs for compliance and incident response

Discovery Timeline

2026-08-10 - CVE-2026-71959 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71959

Vulnerability Analysis

The vulnerability resides in the Bitwarden Events service CollectController, which accepts audit event submissions from authenticated clients. The controller loops through submitted event models and writes them to the target organization's audit log. Before the patch, the code checks only that eventModel.OrganizationId has a value. It does not confirm that the authenticated caller belongs to that organization.

Any logged-in Bitwarden user can craft a POST /collect request specifying another organization's ID. Because the client-supplied timestamp is trusted, the attacker can backdate entries to arbitrary points in time. Injected events can impersonate administrative actions such as Organization_AutoConfirmEnabled_Admin or Organization_InviteLinkClientCopied.

The result is audit log injection that damages log integrity across every organization on the server. Attackers can bury real events under noise, frame legitimate users, or manufacture evidence to defeat repudiation controls.

Root Cause

The root cause is a missing authorization check [CWE-862] in the event ingestion path. The endpoint authenticated the caller but never validated organizational membership against the OrganizationId supplied in the event payload. This is a classic broken access control pattern where authentication was conflated with authorization.

Attack Vector

Exploitation requires only an authenticated Bitwarden user account on the target server. The attacker sends a POST /collect request containing event objects whose OrganizationId points to any organization on the instance. The server persists the events without a membership check, producing forged audit entries with attacker-controlled type, date, and metadata.

text

                case EventType.Organization_AutoConfirmEnabled_Admin:
                case EventType.Organization_AutoConfirmDisabled_Admin:
                case EventType.Organization_InviteLinkClientCopied:
-                   if (!eventModel.OrganizationId.HasValue)
+                   if (!eventModel.OrganizationId.HasValue || !_currentContext.UserId.HasValue)
+                   {
+                       continue;
+                   }
+
+                   // Drop the event if the caller is not a member of the target organization.
+                   var orgMembership = await _organizationUserRepository.GetByOrganizationAsync(
+                       eventModel.OrganizationId.Value, _currentContext.UserId.Value);
+                   if (orgMembership == null)
                    {
                        continue;
                    }

Source: GitHub Bitwarden Commit 2aa92a3. The patch adds a membership lookup via _organizationUserRepository.GetByOrganizationAsync and drops events when the caller is not a member of the target organization.

Detection Methods for CVE-2026-71959

Indicators of Compromise

Audit log entries whose Date field predates the actor account's creation or session activity window.
Event records referencing organizations the acting user is not currently a member of.
Bursts of POST /collect requests from a single account targeting multiple OrganizationId values.
Duplicate or implausibly sequenced administrative event types such as Organization_AutoConfirmEnabled_Admin originating from non-admin users.

Detection Strategies

Correlate ActingUserId in audit log entries against organization membership tables at the recorded event time.
Alert on POST /collect traffic where the request body contains OrganizationId values that do not match the caller's session claims.
Compare event timestamps against server-side receipt time and flag deltas larger than a defined threshold.

Monitoring Recommendations

Ingest Bitwarden Events service logs and reverse proxy access logs into a centralized SIEM for cross-source correlation.
Baseline normal POST /collect volume per user and alert on statistical outliers.
Retain raw HTTP request bodies for the Events endpoint to enable retrospective forensic review.

How to Mitigate CVE-2026-71959

Immediate Actions Required

Upgrade self-hosted Bitwarden Server to version 2026.7.2 or later without delay.
Review audit logs generated before the upgrade for entries that reference organizations the acting user did not belong to.
Rotate administrative credentials if forged administrative events are discovered during review.
Notify organization owners that pre-patch audit records may not be trustworthy for compliance evidence.

Patch Information

Bitwarden released the fix in server version 2026.7.2. The patch, tracked as pull request bitwarden/server#7934 and merged in commit 2aa92a3c, adds an organization membership check in CollectController before persisting any organization-scoped audit event. Release notes are available at the Bitwarden v2026.7.2 release page. Additional analysis is published in the VulnCheck Advisory and the Bitwarden Audit Log Forgery Analysis.

Workarounds

Restrict network access to the Bitwarden Events service to trusted clients while planning the upgrade.
Enforce short session lifetimes and step-up authentication to reduce the pool of accounts that can call /collect.
Increase logging verbosity at the reverse proxy so POST /collect bodies can be reconstructed for forensic review.

bash

# Verify installed Bitwarden Server version and upgrade if below 2026.7.2
docker exec bitwarden-api dotnet --list-runtimes
docker inspect bitwarden/api:latest --format '{{index .Config.Labels "org.opencontainers.image.version"}}'

# Pull and deploy the fixed release
docker compose pull
docker compose up -d