Vulnerabilities/CVE-2026-46651

CVE-2026-46651: Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

SSVC · Estimated by CveMateAttendEscalate and remediate ahead of routine patching. CISA has no entry yet, so CveMate computed this from CVSS and exploit data. It is replaced when CISA publishes.

ExploitationNone (derived)

AutomatableYes (derived)

Technical impactTotal (derived)

Mission & well-beingHigh (assumed)

Source: CveMate estimate, same decision tree as CISA.CISA publishes the first three inputs. Mission & well-being depends on your environment, so it is assumed at its highest: the decision is a worst case.

Deferred

Published 23-10-2026Last modified 23-10-2026

On this page

Summary Timeline Description CVSS metrics EPSS trend Known exploited Public exploits Weaknesses Affected systems References

Key information

Published23-10-2026

Modified23-10-2026

SourceCVE.org

CVSS9.8

EPSSNot scored

KEV0

Exploits0

Vulnerability summary

CVE-2026-46651 is a critical (CVSS 9.8) vulnerability in intranda goobi-viewer-core.

Overall risk

70/100

0100

High · default modelHow is this calculated?

SSVC · Estimated by CveMateAttendEscalate and remediate ahead of routine patching. CISA has no entry yet, so CveMate computed this from CVSS and exploit data. It is replaced when CISA publishes.

ExploitationNone (derived)

AutomatableYes (derived)

Technical impactTotal (derived)

Mission & well-beingHigh (assumed)

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

23-10-2026
PublishedVulnerability first disclosed.

Description

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.

CVSS metrics

2 scores · 2 sources · 1 version

v3.19.8

Critical 9.8Preferred score · CVE.org (CNA)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SourcesAll 2 agree

NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-552Files or Directories Accessible to External PartiesThe product makes files or directories accessible to unauthorized actors, even though they should not be.
CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected systems

Intranda1 product

goobi-viewer-core≥ 24.03, < 26.05

1 vendor · 1 product

References

4 links

github.com/intranda/goobi-viewer-core/security/advisories/GHSA-79jg-3m2m-jgc8X Refsource CONFIRM
github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5X Refsource MISC
github.com/intranda/goobi-viewer-core/commit/b8943ee963e2aa1131da2212eaf85c5a2d90214fX Refsource MISC
github.com/intranda/goobi-viewer-core/releases/tag/v26.05X Refsource MISC

Related vulnerabilities

CriticalCVE-2026-55486intranda · goobi-viewer-core18h agoGoobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSSThe Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.MediumCVE-2026-55465intranda · goobi-viewer-core18h agoGoobi viewer: Solr injection via unvalidated region parameter in spatial searchThe Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenates the user-supplied region query parameter directly into a Solr query string with no escaping, no local-param stripping, and no runtime schema enforcement (the OpenAPI @Schema(pattern=...) annotation is documentation-only at the JAX-RS layer). An attacker can inject Solr local-param syntax ({!parent ...}, {!join ...}) and boolean operators to make access-restricted georeferenced records match the query, bypassing the access-condition filter. This issue has been patched in version 26.05.MediumCVE-2026-55463intranda · goobi-viewer-core18h agoGoobi viewer: WebSocket endpoints lack server-side authentication and origin validationThe Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) accept connections without verifying that the associated HttpSession belongs to a logged-in user, and none validate the Origin header against an allowlist. An unauthenticated attacker can therefore connect to these endpoints; through CampaignEndpoint this allows polluting the in-process crowdsourcing page-lock map and broadcasting forged lock messages, disrupting reviewers' work. This issue has been patched in version 26.05.HighCVE-2026-55459intranda · goobi-viewer-core18h agoGoobi viewer: OpenID JWT audience not enforced by the verifierThe Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.HighCVE-2026-55457intranda · goobi-viewer-core18h agoGoobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypassThe Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.MediumCVE-2026-55444intranda · goobi-viewer-core18h agoGoobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parametersThe Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq. An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope. This issue has been patched in version 26.05.

All vulnerabilities ingoobi-viewer-core