CVE-2026-45083

{
  "id": "CVE-2026-45083",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T22:16:36.820",
  "lastModified": "2026-10-26T12:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to before 26.04.1, the Goobi viewer REST endpoint POST /api/v1/index/stream accepted an arbitrary Solr streaming expression from unauthenticated network clients and forwarded it to the backend Solr server without restriction. An attacker could read the complete Solr index and, in default Solr deployments, also modify or delete indexed records. This vulnerability is fixed in 26.04.1."
    },
    {
      "lang": "es",
      "value": "El visor Goobi es una aplicación web que permite que el material digitalizado se muestre en un navegador web. Desde la versión 4.8.0 hasta antes de la 26.04.1, el endpoint REST del visor Goobi POST /api/v1/index/stream aceptaba una expresión de streaming de Solr arbitraria de clientes de red no autenticados y la reenviaba al servidor Solr de backend sin restricciones. Un atacante podía leer el índice completo de Solr y, en implementaciones predeterminadas de Solr, también modificar o eliminar registros indexados. Esta vulnerabilidad está corregida en la versión 26.04.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "intranda",
          "product": "goobi-viewer-core",
          "versions": [
            {
              "version": ">= 4.8.0, < 26.04.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T13:04:07.852608Z",
          "id": "CVE-2026-45083",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2rgp-f66f-4499",
      "source": "[email protected]"
    }
  ]
}