CVE-2026-71878

CVSS 9.2 (critical) · published 2026-08-18

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Weakness: CWE-306

Source: NVD CVE-2026-71878

References

• https://github.com/gbif/ipt/issues/3115
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0014.md
• https://www.gbif.org/ipt

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.