CVE-2026-71878

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-71878

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71878.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-71878

Published

2026-08-18T17:41:34Z

Modified

2026-09-02T03:30:15Z

Severity

9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Authentication bypass in Integrated Publishing Toolkit

Details

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Database specific

{
    "cna_assigner": "Mandiant",
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71878.json"
}

References

Affected packages

Git / github.com/gbif/ipt

Affected ranges

Type

GIT

Repo

https://github.com/gbif/ipt

Events

Introduced

Fixed

067cf2f083fd0d87334e6344f83d281b04faf8d6

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.3.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

ipt-1.*

ipt-1.0b.4

ipt-1.0b.5

ipt-2.*

ipt-2.3

ipt-2.3.1

ipt-2.3.2

ipt-2.3.3

ipt-2.3.4

ipt-2.3.5

ipt-2.3.6

ipt-2.4.0

ipt-2.4.1

ipt-2.4.2

ipt-2.5.0-RC1

ipt-2.5.1

ipt-2.5.2

ipt-2.5.3

ipt-2.5.4

ipt-2.5.6

ipt-3.*

ipt-3.0-RC1

ipt-3.1.3

ipt-3.1.4

ipt-3.2.0

ipt-3.2.1

ipt-3.2.2

ipt-3.3.0

ipt-3.3.1

ipt-3.3.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71878.json"