Live › vulnerability › CVE-2026-55465
Go to dashboardGoobi viewer's unauthenticated spatial search endpoint pastes a user-supplied region parameter directly into a Solr query without escaping. An attacker can inject Solr local-param syntax and boolean operators to make access-restricted georeferenced records match, bypassing the access filter.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Goobi viewer from 22.04 before 26.05 that expose the REST API to the internet or the network are exposed, because the spatial search endpoint needs no login. Installations that keep the API behind authentication or a private network are at lower risk. Sites on 26.05 or later are not affected.
No product ranges from the sources yet.
22.04 up to but not including 26.05./api/v1/index/{solrField}/spatial/search in the deployed application or its access logs.26.05 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenates the user-supplied region query parameter directly into a Solr query string with no escaping, no local-param stripping, and no runtime schema enforcement (the OpenAPI @Schema(pattern=...) annotation is documentation-only at the JAX-RS layer). An attacker can inject Solr local-param syntax ({!parent ...}, {!join ...}) and boolean operators to make access-restricted georeferenced records match the query, bypassing the access-condition filter. This issue has been patched in version 26.05.
This page as .md · .json · in your agent: get_signal("CVE-2026-55465")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.