Unauthenticated Download Request Vulnerability in Goobi Viewer
CVE-2026-46651

9.8CRITICAL

Key Information:

Vendor

Intranda

Status
Goobi-viewer-core
Vendor
CVE Published:
23 October 2026

What is CVE-2026-46651?

The Goobi Viewer web application presents a security flaw in its DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket). This vulnerability permits unauthenticated users to initiate download requests, compromising the integrity and security of the digitised material presented by the application. It is crucial for users to update to version 26.05, where this issue has been effectively mitigated.

Affected Version(s)

goobi-viewer-core >= 24.03, < 26.05

References

https://github.com/intranda/goobi-viewer-core/security/ad...
x_refsource_CONFIRM
https://github.com/intranda/goobi-viewer-core/commit/5281...
x_refsource_MISC
https://github.com/intranda/goobi-viewer-core/commit/b894...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.