Live › vulnerability › CVE-2026-55444
Go to dashboardThe legacy RSS servlet in Goobi viewer passes the q and filterQuery parameters into Solr queries without validation. An unauthenticated attacker can inject Solr boolean operators to drop the access-condition filter, so restricted records appear in the generated RSS feed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Goobi viewer before 26.05 that expose the legacy /rss/ servlet to anonymous visitors and hold records with access restrictions. The sources do not describe a non-default configuration, so the default setup appears to be exposed. Installations already on 26.05 or later are not affected.
No product ranges from the sources yet.
26.05 are affected.GET /rss/ on the viewer and see whether the feed includes records that are access-restricted for anonymous users.26.05 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq. An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope. This issue has been patched in version 26.05.
This page as .md · .json · in your agent: get_signal("CVE-2026-55444")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.