{"schema":"threatline.record/2","record":{"id":"CVE-2026-55463","aliases":["GHSA-h5m9-fpvw-qr36"],"summary":"Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation","details":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) accept connections without verifying that the associated HttpSession belongs to a logged-in user, and none validate the Origin header against an allowlist. An unauthenticated attacker can therefore connect to these endpoints; through CampaignEndpoint this allows polluting the in-process crowdsourcing page-lock map and broadcasting forged lock messages, disrupting reviewers' work. This issue has been patched in version 26.05.","categories":["Unclassified"],"product":"goobi-viewer-core","vendor":"intranda","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-55463","source_modified_at":"2026-10-23T14:17:06.825Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"goobi-viewer-core","vendor":"intranda","versions":[{"status":"affected","version":">= 4.11.0, < 26.05"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-h5m9-fpvw-qr36","source_modified_at":"2026-06-18T14:58:56Z","fetched_at":"2026-10-24T14:26:37.433577Z","package":{"ecosystem":"maven","name":"io.goobi.viewer:viewer-core"},"range":">=4.11.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-h5m9-fpvw-qr36","source_modified_at":"2026-06-18T14:58:56Z","fetched_at":"2026-10-24T14:26:37.433577Z","package":{"ecosystem":"maven","name":"io.goobi.viewer:viewer-core"},"version":"26.05"}],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T14:17:06.825Z","modified_at":"2026-10-23T14:17:06.825Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-55463","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T14:17:06.825Z"},{"source":"GitHub Advisory Database","url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-h5m9-fpvw-qr36","fetched_at":"2026-10-24T14:26:37.433577Z","source_modified_at":"2026-06-18T14:58:56Z"}],"sources":["CVE List","GitHub Advisory Database"],"references":[{"source":"CVE List","url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-h5m9-fpvw-qr36","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T14:17:06.825Z","content_hash":"f20436aa2e800607521399a4ec57bdfe4b03beb0bf5e7cd515b8e2553c761caa"}}