Goobi viewer CVE-2026-45083
CRITICAL
GHSA-2rgp-f66f-4499
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover internet-exposed Goobi viewer
-
DeliveryPOST crafted streaming expression to /api/v1/index/stream
-
ExploitSolr executes expression unrestricted
-
ExecutionExfiltrate access-restricted documents
-
PersistIssue update()/delete() to tamper or wipe index
-
ImpactForce operator re-index to recover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Goobi viewer Core application (versions 4.8.0 through 26.04) must be deployed with the |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is consistent with the description - a single unauthenticated HTTP POST yields full read, write, and delete on the Solr index, including documents otherwise protected by ACCESSCONDITION restrictions. EPSS is only 0.04% (12th percentile) and the CVE is not in CISA KEV, which together suggest no observed mass-scanning yet; however this likely reflects Goobi viewer's narrow deployment footprint (libraries, archives, museums) rather than exploit difficulty, since the attack is a one-shot curl command. Integrity and availability impact are conditional: index modification/deletion only works against default Solr deployments where update/delete handlers are not locked down, while index read is unconditional. No public PoC is referenced, but the advisory effectively documents the exploit primitive and the GitHub fix commit makes the original handler trivially reconstructable. |
| Exploit ScenarioDerived | An attacker locates an internet-reachable Goobi viewer instance (commonly hosted by libraries and digital archives) and sends an unauthenticated |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Unauthenticated Solr streaming expression injection in Goobi viewer Core (versions 4.8.0 through 26.04) allows remote attackers to fully read, modify, or delete the backend Solr index by posting arbitrary expressions to the /api/v1/index/stream endpoint. No public exploit identified at time of analysis, but the vulnerability is trivially exploitable with CVSS 9.8 and bypasses access-condition protections such as moving walls and licence restrictions. EPSS is currently low (0.04%) reflecting the niche audience rather than technical difficulty.
RemediationAI
Vendor-released patch: upgrade Goobi viewer Core to v26.04.1 or later (https://github.com/intranda/goobi-viewer-core/releases/tag/v26.04.1), which removes the /api/v1/index/stream endpoint and the solr-solrj-streaming dependency per fix commit 326980f24ce1e7cfabf658dd5f615934ca68ebbd. If immediate upgrade is not possible, block the endpoint at a reverse proxy - for Apache httpd add <LocationMatch ^.*api/v[12]/index/stream.*$>Require all denied</LocationMatch> in the vhost - or add a Tomcat <security-constraint> in web.xml denying /api/v1/index/stream and /api/v1/index/stream/* (note: this also blocks any legitimate internal callers, though no such callers ship with the viewer). As a defence-in-depth step, harden the backing Solr instance by disabling the /stream request handler or binding Solr to localhost only so that even direct access requires authentication and update/delete handlers are not exposed; advisory details at https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2rgp-f66f-4499.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Goobi viewer is a Java/Maven web application (pkg:maven/io.goobi.viewer:viewer-core) developed by intranda for presenting digitised cultural heritage collections backed by an Apache Solr index. The vulnerable IndexResource JAX-RS endpoint accepted a raw Solr streaming expression as a text/plain body and forwarded it verbatim to SolrJ's SolrStream, which executes powerful Solr functions including search(), update(), and delete(). The root cause is CWE-306 (Missing Authentication for Critical Function): the endpoint was exposed without any auth-constraint and without filtering the expression grammar, effectively turning the viewer into an open proxy to Solr's full Streaming Expressions API.
Know when Tomcat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
Summary
The Goobi viewer REST endpoint POST /api/v1/index/stream accepted an arbitrary Solr streaming expression from unauthenticated network clients and forwarded it to the backend Solr server without restriction. An attacker could read the complete Solr index and, in default Solr deployments, also modify or delete indexed records.
The API endpoint has now been removed.
Impact
- Complete Solr index read without authentication.
All documents indexed by the viewer including those protected by access conditions such as moving walls, licence requirements or IP restrictions - can be read in full.
- Index data modification.
update() streaming expressions overwrite indexed field values. An attacker can alter metadata, change ACCESSCONDITION values, or corrupt document structure.
- Index data deletion.
delete() streaming expressions permanently remove documents. A single expression can delete the entire collection, requiring a full re-index to recover.
Patches
The endpoint was removed in 326980f24c
Workarounds
Until an update can be deployed, the endpoint should be blocked by a reverse proxy or in the tomcat configuration.
For Apache httpd the following block can be used in the vhost configuration:
<LocationMatch ^.*api/v[12]/index/stream.*$>
Require all denied
</LocationMatch>Alternatively the following security constraint can be added in tomcat via the relevant web.xml:
<security-constraint>
<web-resource-collection>
<web-resource-name>blocked endpoint</web-resource-name>
<url-pattern>/api/v1/index/stream</url-pattern>
<url-pattern>/api/v1/index/stream/*</url-pattern>
</web-resource-collection>
<auth-constraint/>
</security-constraint>References
- Fix commit: 326980f24c
- Introducing commit: 6bfb1cbd42
- Solr Streaming Expressions reference
Contact
If you have any questions or comments about this advisory:
- Email us at [support@intranda.com](mailto:support@intranda.com)
Executive ViewAI
Goobi viewer Core (versions 4.8.0-26.04) contains a critical vulnerability allowing unauthenticated attackers to read, modify, or delete backend search content via an unsecured API endpoint. No public exploit identified at time of analysis, though the vulnerability is trivially exploitable and bypasses document access controls, putting indexed content integrity at risk in affected systems.
Apply vendor patch. Until patched: implement firewall/WAF rules to restrict access to the /api/v1/index/stream endpoint; disable the streaming API if not operationally required; establish monitoring and alerting for unauthorized Solr index modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a r
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
Exploit-DB