Description

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-10T14:17:26.870Z",
  "pubdate": "2026-08-10T14:17:26.870Z",
  "executiveSummary": "Bitwarden Server before version 2026.7.2 contains an authorization bypass vulnerability affecting the audit log collection mechanism. The vulnerability stems from an insufficient validation check within the organization-scoped logging functionality, specifically failing to verify whether the entity issuing a logging request possesses authorized membership within the targeted organization. Any authenticated user can exploit this weakness by submitting malicious requests to the vulnerable endpoint, granting them the ability to append forged and arbitrarily backdated log entries into the audit logs of any arbitrary organization. The resulting impact compromises the integrity, non-repudiation, and forensic reliability of affected organizational audit trails, potentially allowing threat actors to inject false security telemetry, conceal unauthorized activities, or manipulate compliance artifacts. Exploitation requires valid authentication against the Bitwarden Server instance, but does not necessitate membership or administrative privileges within the victim organization, lowering the barrier for internal attackers or compromised accounts to poison forensic logs.",
  "technicalDetails": "The vulnerability resides in the server-side request processing logic handling audit log data ingestion, specifically within the POST /collect request handler. The root cause of the security flaw is a missing authorization check or broken object level authorization (BOLA) during the processing of incoming telemetry payloads. When a client submits a POST request to the /collect endpoint, the request body identifies a target organization for which audit data is being submitted. However, the vulnerable component fails to cryptographically or logically validate whether the authenticated caller initiating the request holds a valid membership or administrative role within the specified organization ID provided in the payload.\nThe exploitation method relies on the transmission of crafted HTTP POST requests directed at the /collect endpoint. Because the server trusts the organizational identifier supplied in the request body without verifying caller association, an attacker authenticated with standard user credentials can populate the payload with foreign organization identifiers and arbitrary log data. Furthermore, the protocol allows the injection of historical timestamps, enabling threat actors to backdate log entries arbitrarily. This allows malicious actors to insert deceptive telemetry into logs of organizations they do not belong to, potentially masking malicious actions or manufacturing false evidence of administrative events.\nThe attack flow proceeds as follows: First, the attacker establishes an authenticated session with the Bitwarden Server. Second, the attacker crafts an HTTP POST request targeting the POST /collect endpoint. The request body is populated with the targeted victim organization identifier and forged log entries containing manipulated timestamps and event data. Third, the Bitwarden Server processes the incoming request, parses the payload, and writes the supplied entries directly into the target organization's audit log database without performing membership validation. Finally, the malicious entries are committed, corrupting the historical audit trail of the victim organization.\nThe affected component is the audit log collection subsystem of Bitwarden Server prior to version 2026.7.2. The attack vector is network-based, requiring network exposure of the Bitwarden Server API and a valid user account for authentication. Privilege requirements are low, as any authenticated user can successfully exploit the lack of caller validation. Post-exploitation impact includes severe log poisoning, evasion of forensic detection, tampering with compliance logs, and the potential subversion of security monitoring systems that rely on Bitwarden audit data for incident response and threat hunting."
}