Login Request a demo
Critical severity · published May 27, 2026
CVE-2026-45083
Goobi viewer: Unauthenticated Solr Streaming Expression Proxy
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to before 26.04.1, the Goobi viewer REST endpoint POST /api/v1/index/stream accepted an arbitrary Solr streaming expression from unauthenticated network clients and forwarded it to the backend Solr server without restriction. An attacker could read the complete Solr index and, in default Solr deployments, also modify or delete indexed records. This vulnerability is fixed in 26.04.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
goobi-viewer-core · intranda
>= 4.8.0, < 26.04.1 · source: vendor
Affected product
GO
goobi-viewer-core
intranda
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45083
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45083
github.com
https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd
github.com
https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705
github.com
https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2rgp-f66f-4499
More from goobi-viewer-core
9.8
CVE-2026-46652
Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer
9.8
CVE-2026-46651
Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer
9.3
CVE-2026-55486
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
7.4
CVE-2026-55459
Goobi viewer: OpenID JWT audience not enforced by the verifier
7.4
CVE-2026-55457
Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass