CVE-2026-71878

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

CVSS

No CVSS.

References

Link	Resource
https://github.com/gbif/ipt/issues/3115
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0014.md
https://www.gbif.org/ipt

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Ausencia de autenticación en la funcionalidad de configuración inicial que queda expuesta después de que se completa la configuración inicial en versiones de GBIF Integrated Publishing Toolkit anteriores a la 3.3.4 permite a atacantes remotos autenticados obtener control administrativo mediante omisión de autenticación.

Information

Published : 2026-08-18 18:19

Updated : 2026-10-22 22:10

NVD link : CVE-2026-71878

Mitre link : CVE-2026-71878

CVE.ORG link : CVE-2026-71878

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-71878", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71878", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T19:28:23.448647Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "mandiant-cve@google.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "mandiant-cve@google.com", "affectedData": [{"vendor": "GBIF", "product": "Integrated Publishing Toolkit", "versions": [{"status": "affected", "version": "0", "lessThan": "3.3.4", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-18T18:19:32.817", "references": [{"url": "https://github.com/gbif/ipt/issues/3115", "source": "mandiant-cve@google.com"}, {"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0014.md", "source": "mandiant-cve@google.com"}, {"url": "https://www.gbif.org/ipt", "source": "mandiant-cve@google.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "mandiant-cve@google.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass"}, {"lang": "es", "value": "Ausencia de autenticaci\u00f3n en la funcionalidad de configuraci\u00f3n inicial que queda expuesta despu\u00e9s de que se completa la configuraci\u00f3n inicial en versiones de GBIF Integrated Publishing Toolkit anteriores a la 3.3.4 permite a atacantes remotos autenticados obtener control administrativo mediante omisi\u00f3n de autenticaci\u00f3n."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "mandiant-cve@google.com"}