CVE-2026-71879
CriticalCVSS 9.1Summary
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass.
Risk Assessment
An attacker can gain full control over the system, potentially leading to unauthorized changes in published data and compromising system integrity.
Recommendation
Update GBIF Integrated Publishing Toolkit to version 3.3.4 or later and ensure the initial setup functionality is disabled after installation.
Original NVD description (English source)
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass