CVE-2026-71878

Authentication bypass in Integrated Publishing Toolkit

State: Published
Severity: 9.2 Critical
Published: Aug 18, 2026
Updated: Aug 18, 2026
Reserved: Aug 7, 2026

Description

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N	Mandiant

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
Integrated Publishing ToolkitGBIF	before 3.3.4Affected

References

https://www.gbif.org/iptproduct
https://github.com/gbif/ipt/issues/3115patch
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0014.mdthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.