Unauthorized Access Through Solr Query Injection in Goobi Viewer by Intranda

CVE-2026-55465

What is CVE-2026-55465?

The Goobi Viewer, a web application by Intranda designed for displaying digitized content, contains a security flaw that exposes sensitive georeferenced records. An unauthenticated REST endpoint allows attackers to inject malicious Solr local-param syntax into the query string, leading to unauthorized access to restricted data. This vulnerability arises from insufficient input validation and improper query processing, enabling an attacker to bypass access controls. Users are advised to update to version 26.05, where this issue has been addressed.

References