CVE-2026-55457 Details

An authorization bypass vulnerability has been identified in Goobi Viewer versions prior to 26.05. The issue arises because the application does not properly validate the Web API token in the AuthorizationFilter. When the webapi.authorization.token is not set, the default behavior is to return an empty string. The filter then accepts requests to any @AuthorizationBinding-protected endpoint with an empty token value, without verifying if a valid token is configured. This vulnerability allows unauthenticated users to access restricted REST methods, potentially leading to unauthorized deletion of records from the Solr index or access to sensitive operational data. The flaw is most likely to be exploited in test or staging environments where the token is not properly set.

Users can upgrade to Goobi Viewer version 26.05 or later, where this vulnerability has been fixed. Alternatively, for versions prior to 26.05, the webapi.authorization.token can be set to a high-entropy random value, such as a UUID, to mitigate the issue.