{"id":"CVE-2026-55465","kind":"vulnerability","aliases":["CVE-2026-55465"],"related":[],"title":"Goobi viewer: unauthenticated Solr query injection exposes access-restricted records","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenates the user-supplied region query parameter directly into a Solr query string with no escaping, no local-param stripping, and no runtime schema enforcement (the OpenAPI @Schema(pattern=...) annotation is documentation-only at the JAX-RS layer). An attacker can inject Solr local-param syntax ({!parent ...}, {!join ...}) and boolean operators to make access-restricted georeferenced records match the query, bypassing the access-condition filter. This issue has been patched in version 26.05.","summary":"Goobi viewer's unauthenticated spatial search endpoint pastes a user-supplied region parameter directly into a Solr query without escaping. An attacker can inject Solr local-param syntax and boolean operators to make access-restricted georeferenced records match, bypassing the access filter.","severity":"medium","cvss":5.3,"epss":0.0044,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["digital-libraries","goobi-viewer","java","package","self-hosted"],"not_affected_if":["api-not-exposed","version-26.05-or-later"],"how_to_check":"- Check the installed Goobi viewer version; affected releases are from `22.04` up to but not including `26.05`.\n- Look for the endpoint `/api/v1/index/{solrField}/spatial/search` in the deployed application or its access logs.","fix":"- Upgrade Goobi viewer to `26.05` or later.","status":"open","published_at":"2026-10-23T15:17:33+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:18:48+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:18:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Goobi viewer to `26.05` or later.","reach":"internet","title":"Goobi viewer: unauthenticated Solr query injection exposes access-restricted records","impact":"medium","summary":"Goobi viewer's unauthenticated spatial search endpoint pastes a user-supplied region parameter directly into a Solr query without escaping. An attacker can inject Solr local-param syntax and boolean operators to make access-restricted georeferenced records match, bypassing the access filter.","category":"package","nicknames":[],"who_cares":["goobi-viewer","digital-libraries","java","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Access-restricted georeferenced records become visible to anonymous users.","analyst_note":"","how_to_check":"- Check the installed Goobi viewer version; affected releases are from `22.04` up to but not including `26.05`.\n- Look for the endpoint `/api/v1/index/{solrField}/spatial/search` in the deployed application or its access logs.","needs_analyst":false,"not_affected_if":["version-26.05-or-later","api-not-exposed"],"who_is_affected":"Deployments of Goobi viewer from 22.04 before 26.05 that expose the REST API to the internet or the network are exposed, because the spatial search endpoint needs no login. Installations that keep the API behind authentication or a private network are at lower risk. Sites on 26.05 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000618,"input_tokens":3457,"output_tokens":545,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-55465':14A,17A '/api/v1/index':104C '/spatial/search':106C '22.04':94C '26.05':98C,186C 'access':9A,65B,72B,166C,176C 'access-condit':175C 'access-restrict':8A,64B,165C 'allow':82C 'annot':138C 'applic':80C 'attack':51B,150C 'boolean':60B,161C 'browser':91C 'bypass':70B,173C 'concaten':107C 'condit':177C 'cve':12A,15A 'digit':19B 'digital-librari':18B 'digitis':83C 'direct':43B,115C 'display':87C 'document':141C 'documentation-on':140C 'endpoint':35B,102C 'enforc':133C 'escap':49B,123C 'expos':7A 'filter':73B,178C 'georeferenc':67B,168C 'get':103C 'goobi':1A,22B,29B,75C 'goobi-view':21B 'host':28B 'inject':6A,53B,152C 'issu':180C 'java':24B 'jax':146C 'jax-r':145C 'join':159C 'layer':148C 'librari':20B 'local':56B,126C,155C 'local-param':55B,125C,154C 'make':63B,164C 'match':69B,170C 'materi':84C 'openapi':135C 'oper':61B,162C 'packag':25B 'param':57B,127C,156C 'paramet':42B,114C 'parent':158C 'past':36B 'patch':183C 'pattern':137C 'queri':5A,47B,113C,119C,172C 'record':11A,68B,169C 'region':41B,112C 'rest':101C 'restrict':10A,66B,167C 'rs':147C 'runtim':131C 'schema':132C,136C 'search':34B 'self':27B 'self-host':26B 'solr':4A,46B,54B,118C,153C 'solrfield':105C 'spatial':33B 'string':120C 'strip':128C 'suppli':40B,111C 'syntax':58B,157C 'unauthent':3A,32B,100C 'user':39B,110C 'user-suppli':38B,109C 'version':93C,97C,185C 'viewer':2A,23B,30B,76C 'web':79C,90C 'without':48B","nicknames":[],"mitigations":[],"who_affected":"Deployments of Goobi viewer from 22.04 before 26.05 that expose the REST API to the internet or the network are exposed, because the spatial search endpoint needs no login. Installations that keep the API behind authentication or a private network are at lower risk. Sites on 26.05 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55465","severity":null,"published_at":"2026-10-23T15:17:33+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-55465","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55465","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}