External risk intelligence

Goobi Viewer Unrestricted Solr Streaming Expression Access

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-45083

The vulnerability exists in a REST API endpoint of a web application designed to display digitized material. As a web application providing public access to collections, these instances are typically deployed as internet-facing services to allow users to browse and search content, making the API endpoint reachable from the public internet in common deployment patterns.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in the Goobi viewer, a web application for displaying digitized materials, could allow unauthenticated attackers to access or alter all indexed records if exploited. The issue lies in a REST endpoint that forwards user requests to the backend Solr server without sufficient validation.

Unrestricted access to indexed records.
Critical data exposure or modification risk.
Confirm relevance and exposure of the viewer.

Attack Path

How an attacker could exploit the issue

An attacker on the network can send specially crafted requests to the Goobi viewer's streaming API. Because this endpoint does not require authentication and improperly handles user-supplied input, the attacker can trick the viewer into sending these requests to the backend Solr server. This allows the attacker to read sensitive information from the Solr index and potentially alter or delete records.

Unauthenticated network access required.
Arbitrary request sent to backend Solr.
Read, modify, or delete indexed records.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated network clients could exploit a vulnerability in the Goobi viewer's REST API to read, modify, or delete records within the Solr index. This could occur when the viewer is accessible from the network, potentially impacting the integrity and availability of indexed digitized material.

Solr index records at risk.
Unrestricted API endpoint access.
Indexed data could be modified.

Operational Fix

Recommended remediation, mitigation, and detection steps

Owners of the Goobi viewer application and their associated infrastructure teams are responsible for addressing this critical vulnerability. The first practical step is to identify all instances of the Goobi viewer, confirm their reachability and business criticality, and then plan remediation based on risk.

Identify and confirm Goobi viewer instances.
Verify Solr index access and impact.
Plan and coordinate remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Goobi viewer software used for?

Goobi viewer is a web-based application designed to host and display digitized collections. It provides a user interface that allows the public to search, browse, and view historical documents, books, and other materials stored in backend systems like Apache Solr.

What does CWE-306 mean for CVE-2026-45083?

CWE-306 refers to a Missing Authentication for Critical Function. In this vulnerability, it means the application does not verify the identity of users before allowing them to access a sensitive API endpoint. Because no authentication is required, any network user can send unauthorized commands.

How does an attacker trigger this vulnerability?

An attacker sends a specially crafted streaming expression to the specific /api/v1/index/stream endpoint. The vulnerability is only triggered when this input is accepted and passed to the backend; simply browsing the public-facing digitized content without sending these specific API requests does not trigger the underlying flaw.

Why is this a high-relevance risk for my infrastructure?

Halo Surface Signal notes that because Goobi viewer is typically deployed as an internet-facing service to ensure public access to digitized archives, the vulnerable API endpoint is frequently reachable from the public internet, placing the backend index records at higher risk of unauthorized interaction.

What should I do if I run Goobi viewer?

First, inventory your systems to identify all active instances of the Goobi viewer. Confirm their network reachability and determine if they are running a version prior to 26.04.1. Once identified, plan to update to the latest patched version to remove the unrestricted API access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.