EUVD-2026-61129
GHSA-9cwq-xr29-c4rp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable auth bypass (AV:N/PR:N/UI:N) but success requires the setup endpoint to remain exposed post-install, so AC:H; admin takeover gives C:H/I:H with limited availability impact (A:L).
Primary rating from Vendor (Mandiant).
CVSS VectorVendor: Mandiant
Lifecycle Timeline
2DescriptionCVE.org
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass
AnalysisAI
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets remote attackers gain full administrative control by reaching initial-setup functionality that is never disabled after installation completes. Because the setup workflow - meant to run once on a fresh, unconfigured instance - stays reachable on production servers, an attacker can re-drive it to seize the admin role. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The IPT instance must be a version before 3.3.4 that has already completed its initial setup yet still exposes the one-time setup/installation functionality to the network (the CVSS AT:P attack-requirement reflects this specific left-exposed state rather than a universal default). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L) reflects a network-reachable, low-complexity attack yielding high confidentiality and integrity impact - administrative takeover - but the AT:P (Attack Requirements: Present) metric signals that success depends on a specific deployment state rather than any default install, which tempers real-world exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to GBIF IPT 3.3.4 or later, which the vendor indicates removes or gates the exposed initial-setup functionality (fix tracked at https://github.com/gbif/ipt/issues/3115; see Mandiant MNDT-2026-0014). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all GBIF IPT instances deployed in your environment, documenting their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today