{"id":"CVE-2026-46651","kind":"vulnerability","aliases":["CVE-2026-46651"],"related":[],"title":"Goobi viewer: unauthenticated WebSocket download endpoint allows server-side request abuse","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.","summary":"The DownloadTaskEndpoint WebSocket at /tasks/download/monitor.socket accepts download requests from unauthenticated users in goobi-viewer-core versions 24.03 up to 26.05. The sources (CVSS 9.8, tagged ssrf) indicate an attacker can make the server fetch content on their behalf without logging in.","severity":"critical","cvss":9.8,"epss":0.00697,"exploited":false,"exploited_at":null,"products":[{"name":"goobi-viewer-core","fixed":["26.05"],"affected":">= 24.03, < 26.05","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["goobi-viewer","java","package","runtime","self-hosted","solr","ssrf","websocket"],"not_affected_if":["version-outside-24.03-to-26.05"],"how_to_check":"Check the Maven dependency version of goobi-viewer-core in the project pom or build file; affected if 24.03 <= version < 26.05.","fix":"Upgrade goobi-viewer-core to 26.05 or later.","status":"open","published_at":"2026-10-23T15:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:31:00+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:31:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade goobi-viewer-core to 26.05 or later.","reach":"internet","title":"Goobi viewer: unauthenticated WebSocket download endpoint allows server-side request abuse","impact":"high","summary":"The DownloadTaskEndpoint WebSocket at /tasks/download/monitor.socket accepts download requests from unauthenticated users in goobi-viewer-core versions 24.03 up to 26.05. The sources (CVSS 9.8, tagged ssrf) indicate an attacker can make the server fetch content on their behalf without logging in.","category":"package","who_cares":["goobi-viewer","java","self-hosted","solr","websocket"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated attacker triggers server-side requests and downloads, possibly reaching internal services","analyst_note":"Confirm the exact SSRF impact and whether the endpoint is reachable by default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-46651 and the upstream Goobi viewer 26.05 release notes.","how_to_check":"Check the Maven dependency version of goobi-viewer-core in the project pom or build file; affected if 24.03 <= version < 26.05.\nunknown","needs_analyst":true,"not_affected_if":["version-outside-24.03-to-26.05"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000558,"input_tokens":2990,"output_tokens":518,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Goobi viewer release notes for what a download task exposes and whether a config check exists; the sources give no detail on data reached.","search":"'-2026':14A,17A '-46651':15A,18A '/tasks/download/monitor.socket':39B,105C '24.03':52B,96C '26.05':55B,100C,124C '9.8':59B 'abus':12A 'accept':40B,111C 'allow':7A,84C 'applic':82C 'attack':64B 'behalf':73B 'browser':93C 'content':70B 'core':22A,50B,110C 'cve':13A,16A 'cvss':58B 'digitis':85C 'display':89C 'download':5A,41B,112C 'downloadtaskendpoint':36B,102C 'endpoint':6A,104C 'fetch':69B 'goobi':1A,20A,24B,48B,77C,108C 'goobi-view':23B 'goobi-viewer-cor':47B,107C 'goobi-viewer-core':19A 'host':31B 'indic':62B 'issu':118C 'java':26B 'log':75B 'make':66B 'materi':86C 'packag':27B 'patch':121C 'request':11A,42B,113C 'runtim':28B 'self':30B 'self-host':29B 'server':9A,68B 'server-sid':8A 'side':10A 'solr':32B 'sourc':57B 'ssrf':33B,61B 'tag':60B 'unauthent':3A,44B,115C 'user':45B,116C 'version':51B,95C,99C,123C 'viewer':2A,21A,25B,49B,78C,109C 'web':81C,92C 'websocket':4A,34B,37B,103C 'without':74B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-46651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46651","severity":null,"published_at":"2026-10-23T15:17:31+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-46651:158","url":null,"severity":null,"published_at":"2026-10-23T22:02:52+00:00","modified_at":"2026-10-23T22:02:52+00:00","first_seen_at":"2026-10-23T22:02:52+00:00","fetched_at":"2026-10-23T22:02:52+00:00","note":"Read GHSA-79jg-3m2m-jgc8 (vendor advisory, Jun 18 2026) and v26.05 release; no exploitation or PoC found in search results; no social search done."},{"source":"epss","external_id":"CVE-2026-46651","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-46651","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":1286,"url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-79jg-3m2m-jgc8","title":"GHSA-79jg-3m2m-jgc8 Unauthenticated SSRF and LFI via DownloadTaskEndpoint","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1287,"url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05","title":"goobi-viewer-core v26.05","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}