Integrated Publishing Toolkit
Monthly
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets a remote attacker reach the initial-setup functionality, which stays unauthenticated and exposed until the server's first reboot, and abuse it to seize administrative control of the instance. The flaw was reported by Mandiant, a vendor patch (3.3.4) is available, and there is no public exploit identified at time of analysis. Rated CVSS 4.0 9.1 (Critical), exploitation is gated by a timing/deployment window rather than by raw network reach.
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets remote attackers gain full administrative control by reaching initial-setup functionality that is never disabled after installation completes. Because the setup workflow - meant to run once on a fresh, unconfigured instance - stays reachable on production servers, an attacker can re-drive it to seize the admin role. Reported by Mandiant (MNDT-2026-0014); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets a remote attacker reach the initial-setup functionality, which stays unauthenticated and exposed until the server's first reboot, and abuse it to seize administrative control of the instance. The flaw was reported by Mandiant, a vendor patch (3.3.4) is available, and there is no public exploit identified at time of analysis. Rated CVSS 4.0 9.1 (Critical), exploitation is gated by a timing/deployment window rather than by raw network reach.
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets remote attackers gain full administrative control by reaching initial-setup functionality that is never disabled after installation completes. Because the setup workflow - meant to run once on a fresh, unconfigured instance - stays reachable on production servers, an attacker can re-drive it to seize the admin role. Reported by Mandiant (MNDT-2026-0014); no public exploit identified at time of analysis, and it is not listed in CISA KEV.