CVE-2026-55465 intranda CVE debrief

Who should care

Defenders of Goobi viewer installations, particularly those exposed to the internet or untrusted users, should assess and prioritize patching. This includes reviewing the vulnerability's impact on their specific deployments, verifying access controls, and ensuring proper Solr query validation. Security teams and vulnerability management teams should also be aware of the potential risks and take necessary actions to protect their systems.

Why it matters

The Goobi viewer vulnerability allows attackers to bypass access controls and potentially access restricted georeferenced records. Defenders should prioritize patching and verify access controls and Solr query validation.

• Potential unauthorized access to restricted georeferenced records
• Bypassing of access-condition filters
• Possible data exposure through Solr query manipulation
• Verification of patching and access controls required

Technical summary

The Goobi viewer REST endpoint for spatial search concatenates user-supplied region query parameters directly into a Solr query string without proper escaping or validation. This allows attackers to inject Solr local-param syntax and boolean operators, potentially bypassing access-condition filters for georeferenced records. Affected versions are from 22.04 to before 26.05. Defenders should focus on patching and verifying access controls and Solr query validation to mitigate this vulnerability. The vulnerability allows attackers to bypass access controls and potentially access restricted georeferenced records.

Defensive priority

Medium-priority patching and verification recommended for exposed systems.

Recommended defensive actions

• Patch Goobi viewer installations to version 26.05 or later
• Verify access controls and Solr query validation
• Monitor for suspicious Solr queries
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability and affected versions. Vendor advisories and code changes are available on GitHub (ref-4, ref-5). Defenders should verify patching and access controls, review compensating controls, and monitor for suspicious Solr queries. Evidence limits suggest focusing on confirmed affected versions and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.