Goobi Viewer EUVD-2026-109062

Exploitation requires that webapi.authorization.token is left unconfigured (empty) so that Configuration.getWebApiToken returns an empty string, which AuthorizationFilter then matches against an empty ?token= value. This is a non-default state: the official install guide generates a UUID token, so a guide-following install is NOT exploitable - the condition most often arises on test/staging/CI installs or container images that skip the bootstrap step. The attacker additionally needs network reachability to a @AuthorizationBinding-protected REST endpoint; the client-secret read and GRANTED-access escalation further require the client-applications feature to be in use. The limiting factor is entirely this non-default unset-token configuration (the basis for AC:H); no authentication or user interaction is required once that condition holds.

This is a genuine but conditional authorization-bypass (CWE-287, with CWE-1392 'use of default credentials' per the GHSA advisory) that only matters on a subset of deployments. The input CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N = 7.4) correctly captures the core tension: the flaw is network-reachable and unauthenticated (PR:N), but AC:H reflects that it is NOT exploitable against a guide-following install - the official install guide generates a UUID token, so the empty-token precondition is a non-default state. The vendor explicitly attributes AC:H to this: the bug 'most often surfaces on test/staging/CI installs or container images that skip the bootstrap step.' No EPSS score, no CISA KEV listing, and no PoC/exploit reference were supplied, so exploitation probability signals are absent rather than low - do not read the missing EPSS as evidence of low interest. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a real-but-bounded priority. Net: treat as a priority for anyone running Goobi viewer in automated/containerized/CI contexts where bootstrap may be skipped; lower urgency for guide-following production installs that already set a token. No conflicting signals in the CVSS vs. description - both agree on network, unauthenticated, config-dependent access.

An operator deploys Goobi viewer from a container image or CI/staging setup that skipped the bootstrap step, leaving webapi.authorization.token unset. A remote, unauthenticated attacker who can reach the REST API sends a request to any @AuthorizationBinding-protected endpoint with an empty token value (e.g. ?token=), which the filter accepts, and then issues DELETE /api/v1/records/{pi} to delete Solr index records or reads operational/client-secret data. No public exploit was identified in the supplied data, though the trivial trigger (an empty token parameter) requires no specialized tooling.