by Kastro
Paper/Archive/CVE-2026-71878

CVE-2026-71878

GBIF Integrated Publishing Toolkit — Authentication bypass in Integrated Publishing Toolkit

EPSS 0.9%CVSS 9.2
critical.is priorityof 100
39
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 58.5.585 × 2011.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Affected

ProductAffectedFixed inSource
Integrated Publishing Toolkit< 3.3.43.3.4CNA

Scores by source

Mandiant (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgbif.org/iptpatchgithub.com/gbif/ipt/issues/3115writeupgithub.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0014.md