CVE-2026-55463

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) accept connections without verifying that the associated HttpSession belongs to a logged-in user, and none validate the Origin header against an allowlist. An unauthenticated attacker can therefore connect to these endpoints; through CampaignEndpoint this allows polluting the in-process crowdsourcing page-lock map and broadcasting forged lock messages, disrupting reviewers' work. This issue has been patched in version 26.05.

• CWE-306
• CWE-862
• CWE-1385

• https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412
• https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
• https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-h5m9-fpvw-qr36

Published

Oct 23, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55457The Goobi viewer is a web application that allows digitised …7.4
• CVE-2026-55459The Goobi viewer is a web application that allows digitised …7.4
• CVE-2026-5546A flaw has been found in Campcodes Complete Online Learning …6.3
• CVE-2026-55460Snipe-IT is an IT asset/license management system. Prior to …7.1
• CVE-2026-55461Snipe-IT is an IT asset/license management system. Prior to …6.1
• CVE-2026-55462Snipe-IT is an IT asset/license management system. Prior to …4.3
• CVE-2026-55464Snipe-IT is an IT asset/license management system. Prior to …5.4
• CVE-2026-55465The Goobi viewer is a web application that allows digitised …5.3
• CVE-2026-55466Snipe-IT is an IT asset/license management system. Prior to …8.7
• CVE-2026-55467OpenPrinting CUPS is an open source printing system for Linu…2.5
• CVE-2026-55468Wagtail is an open source content management system built on…4.3
• CVE-2026-55469Snipe-IT is an IT asset/license management system. Prior to …6.5