Goobi viewer EUVD-2026-109061

Exploitation requires that the legacy RSS servlet (RssResolver, GET /rss/) be reachable on a Goobi viewer-core instance prior to 26.05; this servlet predates the REST API and lacks the input validation present in GET /api/v1/records/rss. No authentication, user interaction, or non-default toggle is required to reach the endpoint (AV:N/AC:L/PR:N/UI:N). The meaningful limiting factor is data-dependent: the disclosure only yields sensitive results on instances that actually hold access-restricted records, since the attack renders the access-condition filter suffix optional; instances serving only public material have nothing additional to leak. Impact is further bounded to the specific metadata fields the feed renders (title, author, publisher, place/year, shelfmark, URN, persistent identifier, record link) - the Solr FULLTEXT field is not stored or rendered and restricted thumbnails remain separately access-gated.

Severity is genuinely moderate and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) describes a remote, unauthenticated, low-complexity flaw whose only impact is limited confidentiality - bibliographic metadata of access-restricted records leaked through the RSS feed, with no integrity or availability effect and no full-text exposure. No EPSS score and no KEV listing are present in the input, and no public exploit code is referenced (only the vendor advisory, patch commits, and the release tag), so there is no evidence of active or at-scale exploitation. The vuln.today decision label is 'this_month', which aligns with the picture of a real but non-emergency confidentiality issue rather than an act_now/emergency item. The one caveat is impact scope: the leak only matters on instances that actually host access-restricted records, so for an instance serving only public material the practical risk is close to nil. Net: a legitimate patch-this-cycle issue for affected libraries/archives, not a drop-everything priority, and the low real-world footprint of the product further bounds aggregate risk.

An unauthenticated attacker sends a crafted GET request to the legacy /rss/ servlet, placing Solr boolean operators in the q (and/or filterQuery) parameter to break out of the literal-parenthesis wrapping and make the trailing access-condition filter-query suffix optional. The returned RSS feed then includes access-restricted records, disclosing their title, author, publisher, place/year, shelfmark, URN, persistent identifier, and record link; the injection can also run count/oracle queries against the Solr index. No public exploit code is referenced in the available sources; the attack is low-complexity and requires no authentication or user interaction.