by Kastro
Paper/Archive/CVE-2026-71879

CVE-2026-71879

GBIF Integrated Publishing Toolkit — Authentication bypass in Integrated Publishing Toolkit

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 58.5.585 × 2011.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Affected

ProductAffectedFixed inSource
Integrated Publishing Toolkit< 3.3.43.3.4CNA

Scores by source

Mandiant (CNA)9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgbif.org/iptpatchgithub.com/gbif/ipt/issues/3115writeupgithub.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0015.md