CVE-2026-71879

critical · 9.1

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

9.1

CVSS

0.9%

EPSS (exploit prob.)

58th

EPSS percentile

2026-08-18

Published

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-288

References

https://github.com/gbif/ipt/issues/3115
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0015.md
https://www.gbif.org/ipt

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-71879