Bitwarden Server CVE-2026-71959

Exploitation requires a valid, authenticated Bitwarden Server account - the attacker does not need membership, admin rights, or any role within the targeted organization. The attacker must have network access to the Bitwarden Server API and a valid session token or credentials for any account on that server instance. No special server configuration, feature flag, or non-default setting is required; the vulnerable endpoint is part of standard server operation. Exploitation is bounded in scope: only audit log integrity of the targeted organization is affected - vault contents, user credentials, encryption keys, and availability are not impacted. The vulnerability is specific to the self-hosted Bitwarden Server product (CPE cpe:2.3:a:bitwarden:server) and does not directly affect client applications. Note: the provided CVSS 4.0 vector's PR:N metric conflicts with the description's 'authenticated user' requirement; if authentication is confirmed as mandatory, the realistic exploitation prerequisite is a low-privilege account (PR:L), not anonymous access.

The vendor-provided CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/SC:N/SI:L/SA:N) reflects a network-accessible, low-complexity attack with no user interaction and a subsequent-system integrity impact. However, a material conflict exists: the CVSS vector specifies PR:N (no privileges required), while the CVE description explicitly states exploitation requires 'any authenticated user' - implying PR:L is the correct metric. This discrepancy should be verified with the vendor or NVD; real-world exploitation is constrained to account holders, slightly raising the bar above the vector implies. The impact is scoped entirely to audit log integrity - no vault data, credentials, or confidentiality is affected - making this a forensic trustworthiness issue. For organizations relying on Bitwarden audit logs for compliance frameworks such as SOC 2, PCI DSS, or ISO 27001, the practical risk is significant: forged or backdated entries can invalidate incident timelines and compliance attestations. A publicly available PoC raises exploitation likelihood, though the absence of a CISA KEV listing indicates no confirmed mass or targeted exploitation at time of analysis.

An attacker with any valid Bitwarden account on the target server - including a low-privilege personal vault user with no organizational role - authenticates to the API and sends a POST /collect request with a victim organization's ID in the body, fabricated event type, and a backdated timestamp. The server, lacking an authorization check on the organization field, persists the forged entry into the victim organization's audit log. A public PoC demonstrating this technique is available at sanjokkarki.com.np, lowering the technical barrier to exploitation.