The GBIF Integrated Publishing Toolkit contains a missing authentication vulnerability (CWE-306) in its initial setup functionality that remains accessible even after the initial setup is completed. This allows remote unauthenticated attackers to bypass authentication mechanisms and obtain administrative privileges. The vulnerability is identified in versions prior to 3.3.4. The CVSS 4.0 score is 9.2, indicating a critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity. No vendor advisory or patch information is currently available.

Remote attackers can bypass authentication controls in the initial setup functionality to gain administrative access to the GBIF Integrated Publishing Toolkit. This could lead to full administrative control over the affected system, potentially compromising confidentiality, integrity, and availability of the system and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the initial setup functionality and monitor for unauthorized access attempts.