CVEvulnerability

CVE-2026-71879

9.1 CRITICAL Published 2026-08-18 Modified 2026-10-22 Official page ↗

Status: Awaiting Analysis
Published: 2026-08-18
Last modified: 2026-10-22
Assigner: [email protected]
CVSS 4.0 ([email protected]): 9.1 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses: CWE-288

Description

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Weakness · CWE (1)

CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References

https://github.com/gbif/ipt/issues/3115 github.com
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0015.md github.com
https://www.gbif.org/ipt www.gbif.org

CVE-2026-71879

Description

Related

Weakness · CWE (1)

References