What is GHSA-25rh-cr4w-2wx6?

GHSA-25rh-cr4w-2wx6 is a security advisory published by GitHub Security Advisories with Critical severity. Missing authentication in initial setup functionality left exposed until first reboot in GBIF...

Which CVE IDs does GHSA-25rh-cr4w-2wx6 cover?

GHSA-25rh-cr4w-2wx6 covers the following CVE IDs: CVE-2026-71879. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-25rh-cr4w-2wx6Critical

Missing authentication in initial setup functionality left exposed until first reboot in GBIF...

Vendor

GitHub Security Advisories

Published

August 18, 2026

Last Modified

August 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-71879 →

📋 Description

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-71879
https://github.com/gbif/ipt/issues/3115
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0015.md
https://www.gbif.org/ipt
https://github.com/advisories/GHSA-25rh-cr4w-2wx6