CVE-2026-71878

critical · 9.2

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

9.2

CVSS

0.9%

EPSS (exploit prob.)

58th

EPSS percentile

2026-08-18

Published

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-306

References

https://github.com/gbif/ipt/issues/3115
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0014.md
https://www.gbif.org/ipt

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-71878