CVE-2026-71879CWE-288

CVE-2026-71879

published August 18, 2026

CVSS
9.1
EPSS
1%
Percentile
58.0
In the wild
Unconfirmed
What it is

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

The record
Technical detail
CVSS
9.1 · NONE
CVSS v4.0
9.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00858 · 58.0th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-08-18T22:19Z
References (3)
https://github.com/gbif/ipt/issues/3115 · [email protected]https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0015.md · [email protected]https://www.gbif.org/ipt · [email protected]
EPSS history
Timeline
  • 18 AUG 17:41Z
    Authentication bypass in Integrated Publishing Toolkit
    cvelistv5