CVE-2026-55465 Details
Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenates the user-supplied region query parameter directly into a Solr query string with no escaping, no local-param stripping, and no runtime schema enforcement (the OpenAPI @Schema(pattern=...) annotation is documentation-only at the JAX-RS layer). An attacker can inject Solr local-param syntax ({!parent ...}, {!join ...}) and boolean operators to make access-restricted georeferenced records match the query, bypassing the access-condition filter. This issue has been patched in version 26.05.
A Solr injection vulnerability has been identified in the Goobi Viewer web application, specifically in versions 22.04 prior to 26.05. The issue resides in the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search, where the user-supplied region query parameter is concatenated directly into a Solr query string. This concatenation occurs without proper escaping, local-param stripping, or runtime schema enforcement. As a result, an attacker can inject Solr local-param syntax and boolean operators to manipulate access-restricted georeferenced records, bypassing the access-condition filter. The vulnerability has been patched in version 26.05.
Users can update to Goobi Viewer version 26.05 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/intranda/goobi-viewer-core/commit/46fb8759caa91b5ba9f0c387e5a0d0d3875bf633 | [email protected] | Source CodeVendor |
| https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05 | [email protected] | Release NotesVendor |
| https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-v5h4-qrx3-qg3h | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| intranda Goobi viewer | >= 22.04, < 26.05 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |