Collibra’s REST API contains a set of endpoints under the "/rest/*" path that are protected by authentication checks. Due to an improper authentication implementation in the Collibra Agent, the service does not enforce credentials on these endpoints. The flaw allows an attacker to invoke privileged functionality without authentication, thereby compromising confidentiality and integrity of data managed by the platform. This vulnerability is an instance of improper authentication (CWE-287).

Both the SaaS and on‑prem deployments of Collibra Platform are affected. The advisory does not specify exact release versions, so administrators should verify the installation version and consult Collibra for the applicable fix.

The API is publicly reachable, and the flaw can be exploited remotely without user interaction. The CVSS score of 8.2 indicates high severity. Although no EPSS score is available and the vulnerability is not listed in CISA KEV, the lack of authentication combined with exposed privileged endpoints suggests a high likelihood of exploitation from any system that can reach the REST API. The likely attack vector is remote unauthenticated access to any internet‑exposed or externally reachable "/rest/*" endpoint.