Goobi Viewer Core EUVD-2026-109065

The target must run goobi-viewer-core from 4.11.0 up to (not including) 26.05 with the affected Jakarta WebSocket endpoints (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) network-reachable; no authentication, credentials, or user interaction are required because the endpoints accept any connection without verifying the HttpSession belongs to a logged-in user and perform no Origin allowlist check (the new originValidation guard is disabled by default even after patch, so updating to 26.05 - which adds the server-side user check - is the fix). The practical LIMIT on impact is that the demonstrated CampaignEndpoint disruption only matters where crowdsourcing campaigns are actively in use by reviewers whose lock state can be polluted; environments not using crowdsourcing see little effect, and the overall impact is confined to workflow integrity rather than system compromise. The lack of Origin validation additionally exposes logged-in users to cross-site WebSocket hijacking (CSWSH) if they visit an attacker-controlled page.

This is a real-but-moderate priority, not a high-CVSS-but-trivial issue and not an emergency. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction, which legitimately elevates exposure; CWE-306 (missing authentication) is corroborated by the GHSA advisory and the patch commit, which adds a server-side requireUser check to CampaignEndpoint. However, the impact is bounded (C:L/I:L/A:N): the concrete demonstrated effect is polluting an in-process crowdsourcing page-lock map and broadcasting forged lock messages to disrupt reviewers - a workflow-integrity nuisance rather than code execution, data theft, or outage. No EPSS score was supplied, so exploitation probability cannot be quantified; the CVE is not in CISA KEV, and no public exploit or PoC reference is present in the input, so there is no public exploit identified at time of analysis. The vuln.today Decision label is 'this_month' (not act_now/emergency), consistent with these signals. The most important risk amplifier is cross-source: the advisory explicitly notes the same unauthenticated DownloadTaskEndpoint underlies a separately-advised SSRF/LFI chain (GHSA-79jg-3m2m-jgc8), so this authentication gap is the shared root cause of a more serious issue tracked elsewhere. No signals conflict; the main gap is the absence of EPSS/KEV/PoC data, meaning likelihood is inferred from the vector rather than measured.

An unauthenticated attacker with network reachability to a Goobi viewer instance (versions 4.11.0 up to before 26.05) opens a Jakarta WebSocket connection to CampaignEndpoint without any valid logged-in session. Because the endpoint does not verify the HttpSession belongs to an authenticated user and does not validate the Origin header, the attacker injects forged page-lock messages that pollute the in-process crowdsourcing lock map, locking pages reviewers need and broadcasting spurious lock state to disrupt their work. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means no special timing or preconditions are required beyond reaching the endpoint.