CVE-2026-71878CWE-306

CVE-2026-71878

published August 18, 2026

CVSS
9.2
EPSS
1%
Percentile
58.0
In the wild
Unconfirmed
What it is

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

The record
Technical detail
CVSS
9.2 · NONE
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00858 · 58.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-18T22:19Z
References (3)
https://github.com/gbif/ipt/issues/3115 · [email protected]https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0014.md · [email protected]https://www.gbif.org/ipt · [email protected]
EPSS history
Timeline
  • 18 AUG 17:41Z
    Authentication bypass in Integrated Publishing Toolkit
    cvelistv5