Is CVE-2026-71959 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-71959?

CVE-2026-71959 has a CVSS v3 severity of MEDIUM (5.8).

Back

CVE-2026-71959

Description

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.