CVE-2026-55457 intranda CVE debrief

Who should care

Defenders responsible for Goobi viewer deployments, security teams, and vulnerability management teams should assess exposure and prioritize patching to prevent unauthorized access. Operators and administrators of affected systems should also be aware of the vulnerability and take necessary actions.

Why it matters

The Goobi viewer authorization bypass vulnerability allows unauthenticated access to protected endpoints. Defenders should prioritize patching to version 26.05 or later and verify configuration of webapi.authorization.token.

• Potential unauthorized access to protected endpoints
• Need to verify configuration of webapi.authorization.token
• Requirement to patch to version 26.05 or later

Technical summary

The Goobi viewer web application, prior to version 26.05, has a default empty token configuration for webapi.authorization.token. This allows an attacker to bypass authorization by providing an empty token to protected endpoints. The issue arises from Configuration.getWebApiToken returning an empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. Defenders should prioritize patching to version 26.05 or later.

Defensive priority

Defenders should prioritize patching to version 26.05 or later to prevent unauthorized access.

Recommended defensive actions

• Patch Goobi viewer to version 26.05 or later
• Verify configuration of webapi.authorization.token
• Monitor for unauthorized access attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and source item provide details on the vulnerability and its patch. However, there is limited information on potential exploitation or impact. Defenders should verify configuration of webapi.authorization.token and monitor for unauthorized access attempts. The empty token configuration allows an attacker to bypass authorization by providing an empty token to protected endpoints.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.