CVE-2026-71879 CRITICAL

CVE-2026-71879: Authentication bypass in Integrated Publishing Toolkit

Vendor Gbif

Product Integrated Publishing Toolkit

Weakness CWE-288

Published August 18, 2026

Last update August 18, 2026

View on NVD All CVEs

CVSS base score

9.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Key dates

02Disclosure timeline

August 18, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-71879 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/288.html AskarLabs — CWE-288 write-up Authentication Bypass Using an Alternate Path or Channel

Related vulnerabilities

04Related CVE

CVE-2026-73188 WordPress KiviCare plugin <= 4.5.1 - Sensitive Data Exposure vulnerability CVE-2026-66451 WordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerability CVE-2026-40785 WordPress AutomatorWP plugin <= 5.6.7 - Broken Authentication vulnerability CVE-2026-57698 WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability CVE-2026-2628 All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass