CVE-2026-71879
CVE-2026-71879
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass
Published · last modified .
EPSS exploit prediction
EPSS: 0.009 (56.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 57th percentile — 56.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.009 · change: +0.004
Weakness classification (CWE)
References
- www.gbif.org/ipt (product)
- github.com/gbif/ipt/issues/3115 (patch)
- github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0015.md (third-party-advisory)