CVE-2026-45083
Arbitrary Solr Expression Injection in Goobi viewer
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| goobi | goobi_viewer | From 4.8.0 (inc) to 26.04.1 (exc) |
| goobi | goobi_viewer | 26.04.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Goobi viewer web application versions from 4.8.0 up to but not including 26.04.1. The REST endpoint POST /api/v1/index/stream accepts an arbitrary Solr streaming expression from unauthenticated network clients and forwards it directly to the backend Solr server without any restrictions.
This means that an attacker can send specially crafted requests to this endpoint to execute arbitrary Solr streaming expressions, potentially allowing them to read the entire Solr index.
In default Solr deployments, this can also enable the attacker to modify or delete indexed records.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to sensitive indexed data stored in the Solr server.
An attacker could read confidential information from the Solr index, which may include sensitive or private data.
Additionally, the attacker could modify or delete indexed records, leading to data integrity issues, loss of data, or disruption of services relying on the Solr index.
Because the vulnerability can be exploited remotely without authentication, it poses a high risk to systems using vulnerable versions of the Goobi viewer.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the Goobi viewer to version 26.04.1 or later, where the issue is fixed.