Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq. An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope. This issue has been patched in version 26.05.
Published: 2026-10-23
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access to Restricted Records
Action: Apply Patch
AI Analysis

Impact

A blind query injection flaw exists in the legacy RSS servlet of Goobi viewer, where the q and filterQuery parameters are concatenated directly into Solr queries without validation. By injecting Solr boolean operators in these parameters, an attacker can break out of the intended query wrapper and make the access‑control filter optional, allowing the retrieval of records that the user normally should not be able to view. The flaw is not a code execution issue; it is an access‑control bypass that can lead to unauthorized disclosure of protected content.

Affected Systems

Infrastructure running the Goobi viewer core from intranda, versions prior to 26.05, is affected. The vulnerability is fixed in the 26.05 release and newer. No specific minor version numbers are listed beyond the patch level, so any deployment that has not been upgraded to 26.05 is at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known exploits at this time. The attack can be performed by any unauthenticated user who can craft a GET request to /rss/ with manipulated q or filterQuery parameters, making timely patching a priority.

Generated by OpenCVE AI on October 23, 2026 at 16:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Goobi viewer to version 26.05 or later.
  • If the legacy RSS servlet is not required, disable it or block access to GET /rss/.
  • Ensure that any remaining q or filterQuery inputs are properly escaped or validated before being used in Solr queries.

Generated by OpenCVE AI on October 23, 2026 at 16:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Intranda
Intranda goobi Viewer Core
Vendors & Products Intranda
Intranda goobi Viewer Core

Fri, 23 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq. An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope. This issue has been patched in version 26.05.
Title Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters
Weaknesses CWE-20
CWE-89
CWE-943
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Intranda Goobi Viewer Core
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-29T17:54:03.026Z

Reserved: 2026-06-16T21:59:57.018Z

Link: CVE-2026-55444

cve-icon Vulnrichment

Updated: 2026-10-29T17:53:57.802Z

cve-icon NVD

Status : Deferred

Published: 2026-10-23T15:17:32.910

Modified: 2026-10-29T18:17:33.320

Link: CVE-2026-55444

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T23:00:13Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  • CWE-943

    Improper Neutralization of Special Elements in Data Query Logic