CVE-2026-71878
CriticalCVSS 9.2Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass.
Risk Assessment
An attacker can gain full control over the system, potentially leading to unauthorized changes in published data and compromising system integrity.
Recommendation
Update GBIF Integrated Publishing Toolkit to version 3.3.4 or later and ensure the initial setup functionality is disabled after installation.
Other vulnerabilities in GBIF Integrated Publishing Toolkit
See all- CVE-2026-71879Critical
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass.
- CVE-2026-71880High
Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit before version 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection.
Original NVD description (English source)
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass
Vulnerability data from NVD (NIST) · CISA KEV · EPSS