Critical · 9.1 CVE-2026-71879 EUVD-2026-61130GHSA-25rh-cr4w-2wx6

Authentication bypass in Integrated Publishing Toolkit

Published Aug 18, 2026 · Updated Aug 18, 2026 · Assigned by Mandiant

Vendor: GBIF Product: Integrated Publishing Toolkit

Description

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Affected products

Vendor	Product	Affected	Fixed
GBIF	Integrated Publishing Toolkit	< 3.3.4	3.3.4

References

https://www.gbif.org/ipt product
https://github.com/gbif/ipt/issues/3115 patch
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0015.md third-party-advisory