Arbitrary Solr Streaming Expression Vulnerability in Goobi Viewer by Intranda

CVE-2026-45083

What is CVE-2026-45083?

The Goobi Viewer, a web application for displaying digitized materials, has a serious vulnerability related to its REST endpoint. Versions from 4.8.0 up to but not including 26.04.1 are affected. Specifically, the POST /api/v1/index/stream endpoint accepted arbitrary Solr streaming expressions from unauthenticated users, allowing attackers to access the entire Solr index. Furthermore, in default Solr setups, the vulnerability enables attackers to potentially modify or delete indexed records. This poses a significant risk to data integrity and confidentiality. The issue has been addressed in version 26.04.1 as confirmed through recent security advisories.

References