{"id":"CVE-2026-55465","aliases":[],"cve":{"records":[{"id":"CVE-2026-55465","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-16T22:10:37.608Z","published":"2026-10-23T14:17:27.529Z","modified":"2026-10-29T17:55:19.956Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-23T14:17:27.529Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T17:55:19.956Z"}],"references":[{"url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-v5h4-qrx3-qg3h","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/intranda/goobi-viewer-core/commit/46fb8759caa91b5ba9f0c387e5a0d0d3875bf633","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-89","description":"CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","source":"GitHub_M"},{"id":"CWE-943","description":"CWE-943: Improper Neutralization of Special Elements in Data Query Logic","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T17:55:00.493182Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Goobi viewer: Solr injection via unvalidated region parameter in spatial search","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenates the user-supplied region query parameter directly into a Solr query string with no escaping, no local-param stripping, and no runtime schema enforcement (the OpenAPI @Schema(pattern=...) annotation is documentation-only at the JAX-RS layer). An attacker can inject Solr local-param syntax ({!parent ...}, {!join ...}) and boolean operators to make access-restricted georeferenced records match the query, bypassing the access-condition filter. This issue has been patched in version 26.05.","score":5.3,"severity":"medium","published":"2026-10-23T14:17:27.529Z","modified":"2026-10-29T17:55:19.956Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"intranda","name":"goobi-viewer-core","platforms":[],"versions":[{"version":">= 22.04, < 26.05","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-55465"}],"remediation":[],"references":["https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-v5h4-qrx3-qg3h","https://github.com/intranda/goobi-viewer-core/commit/46fb8759caa91b5ba9f0c387e5a0d0d3875bf633","https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05"],"sources":[{"name":"CVE","id":"CVE-2026-55465","modified":"2026-10-29T17:55:19.956Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-55465"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-10-29T18:10:41.847Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T06:55:30.992Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T18:20:31.231Z","attemptedAt":"2026-10-29T18:20:31.231Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T18:20:31.221Z","attemptedAt":"2026-10-29T18:20:31.221Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T18:20:31.231Z","attemptedAt":"2026-10-29T18:20:31.231Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-29T18:20:31.221Z","attemptedAt":"2026-10-29T18:20:31.221Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-55465","url":"https://www.first.org/epss/","probability":0.00262,"percentile":0.17997,"date":"2026-10-29","checkedAt":"2026-10-29T18:20:31.221Z"},{"source":"ENISA EUVD","id":"EUVD-2026-109066","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109066","modified":"Oct 23, 2026, 2:17:27 PM","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-10-29T18:20:31.231Z"},{"source":"NVD","id":"CVE-2026-55465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55465","modified":"2026-10-29T18:17:33.430","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-10-29T18:20:31.231Z"}],"aiSummary":{"text":"Goobi viewer versions 22.04 to before 26.05 have a Solr injection vulnerability via the unvalidated region parameter in spatial search, allowing attackers to bypass access restrictions. The weakness is due to improper neutralization of special elements in data query logic. This issue affects the unauthenticated REST endpoint.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:52:44.207Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-55465"}]}}