# MNDT-2026-0015

## Description
The Integrated Publishing Toolkit (IPT) version 3.3.2 contains an authentication bypass vulnerability due to exposed setup functionality accessible to unauthenticated actors on already configured IPT instances. A remote unauthenticated threat actor could use this vulnerability to obtain an application session cookie with administrative permissions. This condition persists as long as the server has not been rebooted since its initial configuration.

## Impact
Very High: Exploitation of this finding enables an unauthenticated threat actor to gain administrative access on the affected IPT instance.

## Exploitability
Low: Exploitation of this finding does not require a threat actor to possess valid credentials to the application and can be performed while unauthenticated. Knowledge of the affected endpoints are required, but no other specialized tooling is required. The condition appears to only be exploitable if the server has not been rebooted after its initial configuration which may limit reliable exploitation of the issue.

## CVE ID
CVE-2026-71879

## Common Weakness Enumeration
CWE-288: Authentication Bypass Using an Alternate Path or Channel

## Details
IPT version 3.3.2 contains an authentication bypass vulnerability due to exposed setup functionality accessible to unauthenticated actors on an already configured IPT instance. A remote unauthenticated threat actor could navigate to the `/setupInstallationComplete.do` endpoint, which will return a `JSESSIONID` cookie for a user with administrative permissions if setup has already been completed. This condition persists as long as the server has not been rebooted since its initial configuration.

## CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N (9.1)

## Resolution
Update IPT to version 3.3.4.

## Discovery Credits
* Kenneth Chiong, Mandiant

## Disclosure Timeline
* 2026-07-15: Mandiant discloses vulnerability to GBIF
* 2026-07-17: GBIF acknowledges the vulnerability and states that a patch is being implemented
* 2026-08-04: 3.3.4 released
* 2026-08-18: Mandiant advisory and CVE published

## References
* [IPT Website](https://www.gbif.org/ipt)
* [Patch](https://github.com/gbif/ipt/milestone/77?closed=1)
* [CVE-2026-71879](https://www.cve.org/CVERecord?id=CVE-2026-71879)