External risk intelligence

Goobi Viewer Unauthenticated Download Task Endpoint Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-46651

The vulnerability exists in a WebSocket endpoint within the Goobi viewer, which is a web application designed to display digitized material. As a public-facing web application, its endpoints are commonly reachable from the internet to serve end-users, making the application's interface and its associated backend service endpoints likely to be exposed in typical deployments.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Goobi viewer, a web application used for displaying digitized materials. This issue allows unauthenticated users to initiate download requests through a specific WebSocket endpoint, potentially leading to unauthorized access or manipulation of data. The primary concern is to confirm if your organization utilizes this technology and the extent of its exposure.

Unauthenticated access to download features.
Ensures all systems using Goobi viewer are checked.
Confirm Goobi viewer relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable Goobi viewer application over the internet without needing any credentials. The attacker can then interact with a specific WebSocket endpoint that handles download requests. By sending a crafted request to this endpoint, an attacker could potentially trigger unintended actions, leading to severe consequences like data compromise or system disruption.

No authentication required.
Triggered via WebSocket download endpoint.
High risk of data compromise and disruption.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated users could download any digitized material from the Goobi viewer through its WebSocket endpoint, potentially impacting the confidentiality and integrity of the displayed content.

Digitized material from the Goobi viewer.
Unauthenticated users can request downloads.
Exposure of sensitive or private digitized content.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Goobi viewer's unauthenticated download request vulnerability likely falls under the responsibility of the application owner and the infrastructure or platform team managing its deployment. The first critical step is to identify all instances of the Goobi viewer, confirm their exposure and business criticality, and then work with the accountable owner to plan remediation.

Application owners must prioritize this issue.
Verify all Goobi viewer deployment exposures.
Plan coordinated remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Goobi viewer software?

Goobi viewer is a web-based application designed for the presentation and display of digitized collections, such as books, manuscripts, and other media archives. Institutions like libraries and museums use it to provide public web browser access to their digital repositories, allowing users to view and interact with these materials online.

What does CWE-306 mean for CVE-2026-46651?

This vulnerability relates to a Missing Authentication for Critical Function (CWE-306). In the context of CVE-2026-46651, it means the application fails to verify who is making a request before performing a sensitive task. Specifically, the software processes download commands from anyone who connects to a specific WebSocket endpoint, bypassing the typical login or permission checks meant to protect digitized content.

How is the WebSocket endpoint triggered?

An attacker triggers this bug by interacting directly with the /tasks/download/monitor.socket endpoint. Because the application does not require authentication, simply sending a crafted download request to this specific path initiates the action. Standard interactions, such as browsing the public catalog or viewing metadata through regular interface links, do not inherently trigger this specific vulnerability.

Is my Goobi viewer instance at risk?

If you are running a version between 24.03 and 26.04, your deployment is affected. Halo Surface Signal indicates that because Goobi viewer is typically a public-facing web application, its backend endpoints are often reachable from the internet by design. If your instance is exposed to the internet, it is likely reachable by an attacker, making this issue a priority regardless of whether the system is internal or external.

How do I respond to this vulnerability?

Your first step is to locate all active Goobi viewer instances within your environment and check their version numbers. Once you identify any systems running version 26.04 or earlier, coordinate with your technical team to upgrade the application to version 26.05 or later. This update includes the necessary security patch to restrict download access to authorized users.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.