CVE-2026-55463 intranda CVE debrief

Who should care

Defenders responsible for Goobi viewer installations, especially those using versions between 4.11.0 and 26.05, should assess exposure and apply patches or mitigations as necessary.

Why it matters

The vulnerability in Goobi viewer allows unauthenticated access to WebSocket endpoints, potentially disrupting critical functionality and requiring prompt verification and mitigation.

• Potential disruption of reviewers' work through forged lock messages
• Possible pollution of the in-process crowdsourcing page-lock map
• Need for verification of Goobi viewer installations for exposure
• Priority for applying patches or mitigations

Technical summary

The Goobi viewer web application, specifically goobi-viewer-core versions from 4.11.0 to before 26.05, has several Jakarta WebSocket endpoints (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) that accept connections without verifying that the associated HttpSession belongs to a logged-in user, and none validate the Origin header against an allowlist. This allows an unauthenticated attacker to connect to these endpoints and potentially disrupt reviewers' work.

Defensive priority

Defenders should prioritize verifying exposure of Goobi viewer installations, especially those using versions between 4.11.0 and 26.05, and apply patches or mitigations as necessary.

Recommended defensive actions

• Verify Goobi viewer installations for exposure, especially versions between 4.11.0 and 26.05
• Apply patches or mitigations as necessary
• Monitor for potential disruptions or anomalies in Goobi viewer usage
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and patched version 26.05. However, there is limited information on actual exploitation or specific attack scenarios.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.