CVE-2026-55465Medium· 5.3▾ SunlitThe Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenate…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Last analysed / modified upstream
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenates the user-supplied region query parameter directly into a Solr query string with no escaping, no local-param stripping, and no runtime schema enforcement (the OpenAPI @Schema(pattern=...) annotation is documentation-only at the JAX-RS layer). An attacker can inject Solr local-param syntax ({!parent ...}, {!join ...}) and boolean operators to make access-restricted georeferenced records match the query, bypassing the access-condition filter. This issue has been patched in version 26.05.
goobi-viewer-core >= 22.04, < 26.05Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55444Medium· 5.3Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters
CVE-2026-55459High· 7.4Goobi viewer: OpenID JWT audience not enforced by the verifier
CVE-2026-55442Medium· 5.3Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection
CVE-2026-46346Medium· 6.5Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset
CVE-2026-55457High· 7.4Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass
CVE-2026-46347Medium· 6.8Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset