CVE-2026-71878
CriticalCVSS 9.2Summary
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass.
Risk Assessment
An attacker can gain full control over the system, potentially leading to unauthorized changes in published data and compromising system integrity.
Recommendation
Update GBIF Integrated Publishing Toolkit to version 3.3.4 or later and ensure the initial setup functionality is disabled after installation.
Original NVD description (English source)
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass