Administrative takeover via exposed setup steps

Authentication bypass in GBIF Integrated Publishing Toolkit before 3.3.4 allows remote attackers to gain admin access via setup requests. SetupAction leaves one-time setup steps reachable after installation and validates later setup state instead of each step's own completion, so crafted requests can reconfigure the data directory and create a new administrator account. No prior account is required, but exploitation depends on reaching the setup endpoints on an already configured instance and can leave previously configured resources inaccessible after the data-directory change.