EUVD-2026-61130
GHSA-25rh-cr4w-2wx6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network auth bypass needing no privileges (PR:N), but AC:H reflects the pre-first-reboot timing window; admin takeover yields C:H/I:H with no availability impact (A:N).
Primary rating from Vendor (Mandiant).
CVSS VectorVendor: Mandiant
Lifecycle Timeline
2DescriptionCVE.org
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass
AnalysisAI
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets a remote attacker reach the initial-setup functionality, which stays unauthenticated and exposed until the server's first reboot, and abuse it to seize administrative control of the instance. The flaw was reported by Mandiant, a vendor patch (3.3.4) is available, and there is no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the IPT instance's initial-setup functionality still be exposed - the description states it is left exposed only until the first reboot, so the attacker must reach the server during that pre-reboot window (this maps to the CVSS AT:P attack requirement). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N) scores 9.1 Critical: network-reachable, low complexity, no privileges and no user interaction, with high confidentiality and integrity impact and no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to GBIF IPT 3.3.4 or later, which closes the exposed initial-setup path; see the fix tracked at https://github.com/gbif/ipt/issues/3115 and Mandiant's advisory at https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0015.md. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately reboot all IPT instances running versions prior to 3.3.4 to close the exposure window and audit access logs for signs of unauthorized administrative activity since deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today