CVE-2026-71878 CRITICAL

CVE-2026-71878: Authentication bypass in Integrated Publishing Toolkit

Vendor Gbif

Product Integrated Publishing Toolkit

Weakness CWE-306 · Missing auth

Published August 18, 2026

Last update August 18, 2026

View on NVD All CVEs

CVSS base score

9.2/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Key dates

02Disclosure timeline

August 18, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-71878 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html AskarLabs — CWE-306 write-up Missing Authentication for Critical Function

Related vulnerabilities

04Related CVE

CVE-2025-7031 Config Pages Viewer - Critical - Access bypass - SA-CONTRIB-2025-086 CVE-2026-1919 Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints CVE-2025-11007 CE21 Suite 2.2.1 - 2.3.1 - Missing Authorization to Unauthenticated Privilege Escalation via Plugin Settings Update CVE-2019-25738 WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change CVE-2026-8732 WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action