Missing Authentication Bypass in GBIF IPT After Setup

Executive Summary

CVE-2026-71878 is an authentication bypass vulnerability in GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4. The setup functionality remains exposed after initial configuration, allowing remote attackers to bypass authentication and gain administrative control by creating new admin accounts.

Useful 0 Not Useful 0

Detection Guidance

Check if the GBIF IPT setup endpoint is accessible without authentication. Test by accessing /setup or similar paths in a browser or using curl commands like curl -v http://<target-IP>/setup. If the setup page loads without requiring login, the system may be vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to take full control of your IPT instance, create unauthorized admin accounts, reconfigure the application, or make existing resources inaccessible. Exploitation requires no special tools and is straightforward.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to gain administrative control of the IPT instance, potentially leading to unauthorized access, data modification, or exfiltration. Such breaches could violate GDPR's data protection requirements or HIPAA's security rules by exposing sensitive data or failing to maintain access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Update GBIF IPT to version 3.3.4 or later immediately. If updating is not possible, restrict access to the setup endpoints via network controls or disable the setup functionality manually. Verify no unauthorized admin accounts were created during exposure.

Useful 0 Not Useful 0