CVE-2026-71879

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

CVSS

No CVSS.

References

Link	Resource
https://github.com/gbif/ipt/issues/3115
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0015.md
https://www.gbif.org/ipt

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Falta de autenticación en la funcionalidad de configuración inicial, que quedó expuesta hasta el primer reinicio en versiones de GBIF Integrated Publishing Toolkit anteriores a la 3.3.4, permite a atacantes remotos autenticados obtener control administrativo mediante omisión de autenticación.

Information

Published : 2026-08-18 18:19

Updated : 2026-10-22 22:10

NVD link : CVE-2026-71879

Mitre link : CVE-2026-71879

CVE.ORG link : CVE-2026-71879

JSON object : View

Products Affected

No product.

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

{"id": "CVE-2026-71879", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71879", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T19:28:53.006976Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "mandiant-cve@google.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "mandiant-cve@google.com", "affectedData": [{"vendor": "GBIF", "product": "Integrated Publishing Toolkit", "versions": [{"status": "affected", "version": "0", "lessThan": "3.3.4", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-18T18:19:32.960", "references": [{"url": "https://github.com/gbif/ipt/issues/3115", "source": "mandiant-cve@google.com"}, {"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0015.md", "source": "mandiant-cve@google.com"}, {"url": "https://www.gbif.org/ipt", "source": "mandiant-cve@google.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "mandiant-cve@google.com", "description": [{"lang": "en", "value": "CWE-288"}]}], "descriptions": [{"lang": "en", "value": "Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass"}, {"lang": "es", "value": "Falta de autenticaci\u00f3n en la funcionalidad de configuraci\u00f3n inicial, que qued\u00f3 expuesta hasta el primer reinicio en versiones de GBIF Integrated Publishing Toolkit anteriores a la 3.3.4, permite a atacantes remotos autenticados obtener control administrativo mediante omisi\u00f3n de autenticaci\u00f3n."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "mandiant-cve@google.com"}