CVE-2026-55463: Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) accept connections without verifying that the associated HttpSession belongs to a logged-in user, and none validate the Origin header against an allowlist. An unauthenticated attacker can therefore connect to these endpoints; through CampaignEndpoint this allows polluting the in-process crowdsourcing page-lock map and broadcasting forged lock messages, disrupting reviewers' work. This issue has been patched in version 26.05.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
goobi-viewer-coreto a version that resolves this vulnerability.Fixed in 26.05
Event History
Frequently Asked Questions
Which deployments are affected?
Goobi goobi-viewer-core versions 4.11.0 through versions before 26.05 are affected. Version 26.05 contains the patch.
What does an attacker need to exploit this issue?
An attacker can connect to the affected Jakarta WebSocket endpoints without being authenticated. The endpoints also do not validate the Origin header against an allowlist.
What is the practical impact of exploitation?
Via CampaignEndpoint, an attacker can pollute the in-process crowdsourcing page-lock map and broadcast forged lock messages. This can disrupt reviewers' work.