{"id":"CVE-2026-55463","kind":"vulnerability","aliases":["CVE-2026-55463"],"related":[],"title":"Goobi viewer: WebSocket endpoints accept unauthenticated connections, letting attackers disrupt reviewers","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) accept connections without verifying that the associated HttpSession belongs to a logged-in user, and none validate the Origin header against an allowlist. An unauthenticated attacker can therefore connect to these endpoints; through CampaignEndpoint this allows polluting the in-process crowdsourcing page-lock map and broadcasting forged lock messages, disrupting reviewers' work. This issue has been patched in version 26.05.","summary":"Several Jakarta WebSocket endpoints in goobi-viewer-core accept connections without checking that the session belongs to a logged-in user, and they do not validate the Origin header. An unauthenticated attacker can pollute the crowdsourcing page-lock map and broadcast forged lock messages, disrupting reviewers' work.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["goobi-viewer","java","runtime","self-hosted","websocket"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed goobi-viewer-core or Goobi viewer version; versions from `4.11.0` up to but not including `26.05` are affected.\n- Confirm whether the crowdsourcing (campaign) feature is in use, since CampaignEndpoint is the path that lets attackers forge lock messages.","fix":"- Upgrade Goobi viewer to `26.05` or later.","status":"open","published_at":"2026-10-23T15:17:33+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:47:12+00:00","updated_at":"2026-10-25T03:47:12+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:47:12Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Goobi viewer to `26.05` or later.","reach":"internet","title":"Goobi viewer: WebSocket endpoints accept unauthenticated connections, letting attackers disrupt reviewers","impact":"low","summary":"Several Jakarta WebSocket endpoints in goobi-viewer-core accept connections without checking that the session belongs to a logged-in user, and they do not validate the Origin header. An unauthenticated attacker can pollute the crowdsourcing page-lock map and broadcast forged lock messages, disrupting reviewers' work.","category":"runtime","nicknames":[],"who_cares":["goobi-viewer","self-hosted","java","websocket"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker disrupts crowdsourcing reviewers by broadcasting forged page-lock messages","analyst_note":"","how_to_check":"- Check the installed goobi-viewer-core or Goobi viewer version; versions from `4.11.0` up to but not including `26.05` are affected.\n- Confirm whether the crowdsourcing (campaign) feature is in use, since CampaignEndpoint is the path that lets attackers forge lock messages.","needs_analyst":false,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running Goobi viewer from version 4.11.0 up to but not including 26.05 are exposed, because the WebSocket endpoints are reachable without a login. Deployments on versions outside that range, or that are not reachable from the internet, have a smaller exposure; the sources do not say how the endpoints behave behind a reverse proxy.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3462,"output_tokens":605,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-55463':14A,17A '26.05':101C,177C '4.11.0':97C 'accept':5A,36B,115C 'allow':85C,151C 'allowlist':138C 'applic':83C 'associ':121C 'attack':9A,60B,141C 'autocompleteendpoint':113C 'belong':43B,123C 'broadcast':70B,163C 'browser':94C 'campaignendpoint':112C,149C 'check':39B 'connect':7A,37B,116C,144C 'core':35B,110C 'crowdsourc':64B,157C 'cve':12A,15A 'digitis':86C 'display':90C 'disrupt':10A,74B,167C 'downloadtaskendpoint':111C 'endpoint':4A,30B,105C,147C 'forg':71B,164C 'goobi':1A,19B,33B,78C,108C 'goobi-view':18B 'goobi-viewer-cor':32B,107C 'header':57B,135C 'host':25B 'httpsession':122C 'in-process':154C 'issu':171C 'jakarta':28B,103C 'java':21B 'let':8A 'lock':67B,72B,160C,165C 'log':47B,127C 'logged-in':46B,126C 'map':68B,161C 'materi':87C 'messag':73B,166C 'none':131C 'origin':56B,134C 'page':66B,159C 'page-lock':65B,158C 'patch':174C 'pollut':62B,152C 'process':156C 'review':11A,75B,168C 'runtim':22B 'self':24B 'self-host':23B 'session':42B 'sever':27B,102C 'therefor':143C 'unauthent':6A,59B,140C 'user':49B,129C 'userendpoint':114C 'valid':54B,132C 'verifi':118C 'version':96C,100C,176C 'viewer':2A,20B,34B,79C,109C 'web':82C,93C 'websocket':3A,26B,29B,104C 'without':38B,117C 'work':76B,169C","nicknames":[],"mitigations":[],"who_affected":"Teams running Goobi viewer from version 4.11.0 up to but not including 26.05 are exposed, because the WebSocket endpoints are reachable without a login. Deployments on versions outside that range, or that are not reachable from the internet, have a smaller exposure; the sources do not say how the endpoints behave behind a reverse proxy.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55463","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55463","severity":null,"published_at":"2026-10-23T15:17:33+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}