CVE-2026-55444Medium· 5.3▾ SunlitThe Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq. An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope. This issue has been patched in version 26.05.
goobi-viewer-core < 26.05Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55465Medium· 5.3Goobi viewer: Solr injection via unvalidated region parameter in spatial search
CVE-2026-55442Medium· 5.3Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection
CVE-2026-55459High· 7.4Goobi viewer: OpenID JWT audience not enforced by the verifier
CVE-2026-46346Medium· 6.5Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset
CVE-2026-55457High· 7.4Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass
CVE-2026-46347Medium· 6.8Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset