Goobi Viewer EUVD-2026-109066

No authentication, special configuration, or user interaction is required to reach the vulnerable endpoint: GET /api/v1/index/{solrField}/spatial/search is unauthenticated (PR:N) and the region parameter is concatenated raw into the Solr query. However, meaningful data disclosure is limited by deployment specifics - the target must hold access-restricted georeferenced records, and the exposed fields are fixed by a server-side allow-list and the deployment's configured geomap metadata templates (coordinates, PI, and rendered label metadata only). Non-georeferenced records and the unstored full-text field cannot be reached by this vector, and the sibling heatmap endpoint is unaffected because it uses SolrJ's structured setRegionQuery. Exploitation is further limited to goobi-viewer-core versions >= 22.04 and < 26.05.

This is a genuine but moderate-severity access-control bypass, not a high-impact priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 Medium) is internally consistent with the evidence: the endpoint GET /api/v1/index/{solrField}/spatial/search is unauthenticated (PR:N) and reachable over the network with no user interaction, and the only impact is bounded confidentiality (C:L) - disclosure of metadata for access-restricted georeferenced records, with no integrity or availability effect. The vuln.today Decision label is this_month, consistent with a real-but-not-urgent issue. No KEV listing and no EPSS score are present in the input, so there is no signal of active or probable exploitation; the references are a vendor advisory, a fix commit, and a release tag - none is a working exploit, so no public exploit identified at time of analysis. The main reason this is not a top priority despite being unauthenticated and network-reachable is the tightly bounded impact: the returned field set is fixed by a server-side allow-list and the deployment's geomap metadata templates (not attacker-chosen), only georeferenced records are affected, and non-georeferenced records plus the unstored full-text field are never exposed. No signals conflict here; the limiting factor is the narrow data exposure rather than any access barrier.

A remote, unauthenticated attacker sends a GET request to the spatial search endpoint with a region parameter containing Solr local-param syntax (e.g. {!parent ...} or {!join ...}) or boolean operators, which is concatenated unescaped into the Solr query. The injected syntax neutralises the access-condition filter, causing access-restricted georeferenced records to match and return their coordinates, document identifier (PI), and allow-listed metadata. No public exploit identified at time of analysis, though the fix commit and advisory describe the mechanism in detail.