An authenticated user can send a POST request to the /collect endpoint with a payload that specifies any organization identifier. Because the server fails to verify that the caller actually belongs to that organization, it accepts the request and writes forged entries with arbitrary timestamps into the target's audit log. This flaw maps to CWE-862, missing authorization detection, and can be used to obscure malicious activity, mislead investigations, or cover up prior exploitation. The impact therefore is the integrity breach of audit logs rather than direct data exposure or code execution.

Bitwarden Server versions earlier than 2026.7.2 are vulnerable. The issue exists in the default server installation and any deployment of those pre‑release images. All organizational data managed by the server is at risk, as the attacker can target any organization hosted on the affected instance.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, so the likelihood of exploitation in the wild remains uncertain and should be treated as potentially low but not zero. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed exploitation reports yet. Nevertheless, because any authenticated user can trigger the flaw, the attack surface is large within an organization that shares the same Bitwarden instance. Attackers would need only valid credentials, making the condition easy to satisfy in compromised or poorly managed environments.