The vulnerability allows an unauthenticated attacker to supply a crafted region parameter that is directly concatenated into a Solr query string without any escaping, local‑param stripping, or schema enforcement. By injecting Solr local‑param syntax such as {!parent …} or {!join …} and Boolean operators, the attacker can bypass the access‑condition filter and force records that are normally access‑restricted to match the query. The result is the disclosure of georeferenced records to which the attacker has no legitimate permission, effectively elevating privileges to view sensitive data.

Intranda’s Goobi Viewer core is affected. Versions from 22.04 up through the release just before 26.05 (i.e., any release prior to v26.05) contain the vulnerable REST endpoint GET /api/v1/index/{solrField}/spatial/search. The patch that removes the vulnerability is included in v26.05 and later releases.

The CVSS score is 5.3, indicating a moderate impact level. No EPSS score is available, but the vulnerability can be exploited via a simple HTTP request to the public REST endpoint with no authentication. Because the exploitation bypasses internal data‑access filters, it can lead to unauthorized data disclosure. The vulnerability is not listed in the CISA KEV catalog and does not provide remote code execution, but it still poses a significant risk of sensitive data exposure.