Описание
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.
Ссылки
EPSS
Процентиль: 22%
0.00289
Низкий
5.8 Medium
CVSS3
Дефекты
CWE-862
Связанные уязвимости
CVSS3: 5.8
debian
около 1 месяца назад
Bitwarden Server before 2026.7.2 does not verify that the caller is a ...
CVSS3: 5.8
github
около 1 месяца назад
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.
EPSS
Процентиль: 22%
0.00289
Низкий
5.8 Medium
CVSS3
Дефекты
CWE-862