CVE-2026-127279: AIP-PUB ACPs-community Discovery Server main.py missing authentication
A vulnerability was detected in AIP-PUB ACPs-community up to 2.2.0. This impacts an unknown function of the file discovery-server/app/main.py of the component Discovery Server. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Event History
Frequently Asked Questions
Which deployments are potentially affected?
AIP-PUB ACPs-community deployments through version 2.2.0 are potentially affected where the Discovery Server component is in use. The affected code is identified as discovery-server/app/main.py.
What does an attacker need to exploit this issue?
The issue can be exploited remotely and requires no privileges or user interaction according to the supplied vector. A public proof of concept is available, increasing the likelihood of attempted exploitation.
What is the likely impact of successful exploitation?
Successful exploitation may affect confidentiality, integrity, and availability at low impact levels. The reported issue is missing authentication in the Discovery Server.