{"id":"CVE-2026-45083","summary":"Goobi viewer: Unauthenticated Solr Streaming Expression Proxy","details":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to before 26.04.1, the Goobi viewer REST endpoint POST /api/v1/index/stream accepted an arbitrary Solr streaming expression from unauthenticated network clients and forwarded it to the backend Solr server without restriction. An attacker could read the complete Solr index and, in default Solr deployments, also modify or delete indexed records. This vulnerability is fixed in 26.04.1.","aliases":["GHSA-2rgp-f66f-4499"],"modified":"2026-10-28T11:11:00.557635473Z","published":"2026-05-27T21:00:52.103Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-306"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45083.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45083.json"},{"type":"ADVISORY","url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2rgp-f66f-4499"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45083"},{"type":"FIX","url":"https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd"},{"type":"FIX","url":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/intranda/goobi-viewer-core","events":[{"introduced":"dc3533f1a341c4e5b36eb27553f299ffcedb077d"},{"fixed":"11fcd87f6ab77ecbc7e007bace50ad0ad26abe65"},{"fixed":"326980f24ce1e7cfabf658dd5f615934ca68ebbd"},{"fixed":"6bfb1cbd4250b0b347e84a80f38e8bf46acac705"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"4.8.0"},{"fixed":"26.04.1"}]},{"range":[{"fixed":"326980f24ce1e7cfabf658dd5f615934ca68ebbd"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"6bfb1cbd4250b0b347e84a80f38e8bf46acac705"}],"source":"REFERENCES_COMMIT"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45083.json","vanir_signatures":[{"id":"CVE-2026-45083-0ab338e9","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/ApiUrls.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["150474910825043800925042562045539646203","330461506164452685956631063226949901359","189674573377580459489633979715769805174","201246636619232495684660704493068737566"]}},{"deprecated":false,"digest":{"line_hashes":["147649039287009379201124742694435009194","282642399067807433916765889201611769188"],"threshold":0.9},"id":"CVE-2026-45083-0ab65bc7","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/controller/SolrSearchIndex.java"}},{"id":"CVE-2026-45083-182784b5","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/Application.java","function":"init"},"deprecated":false,"digest":{"function_hash":"137176002298015012542001684821142168571","length":379}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/ApiUrls.java"},"deprecated":false,"digest":{"line_hashes":["224112869728488153170763395838288660106","55816821457579975625717129427551867408","262739788322982381379770151585304706607","156039991533206535474047709326837004318","17863637781455604026498255667097166358","18197384966580544179823653737962493407","58943501117570404940150397688632182112","271381584085701775270048568105244744066"],"threshold":0.9},"id":"CVE-2026-45083-23566300"},{"signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705","target":{"file":"goobi-viewer-core/src/test/java/io/goobi/viewer/api/rest/v1/index/IndexResourceTest.java"},"deprecated":false,"digest":{"line_hashes":["89645250548511280395044743160637151414","114120601105245059007645173474156608583","85662344585535361973346744364576699463","324161798927002789337337568694236523125","272252394907840889700108155442585640508","256181522626460880698504362649762255526","85662344585535361973346744364576699463","324161798927002789337337568694236523125","97976962304026424413212184320566802558","126953845588067683560923077707354480068","202081755789817384204577304445759756000","269636789957495447677890876095594384439"],"threshold":0.9},"id":"CVE-2026-45083-309baf44","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705","target":{"file":"goobi-viewer-core/src/test/java/io/goobi/viewer/api/rest/v1/index/IndexResourceTest.java","function":"testQuery"},"deprecated":false,"digest":{"function_hash":"164284937094511887642907859822000011393","length":605},"id":"CVE-2026-45083-5914674b","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["208003071018981288522723960349252814173","140220513331696306766231299537324698349","120261153866251905882794794733719947684","137762447718151797418845777360455392848"],"threshold":0.9},"id":"CVE-2026-45083-5ecb6149","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v2/ApiUrls.java"}},{"id":"CVE-2026-45083-6fcfb205","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/exceptions/WebApplicationExceptionMapper.java","function":"toResponse"},"deprecated":false,"digest":{"function_hash":"71703594554769232992558447542976968867","length":1201}},{"target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/Application.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["59342083027139869268762781898892015744","330061968672887990139865703301612805145","11064228913186787754069797393089061562","57068342373362429664095387340408178844","334058306613229031648642070445446261635","49798277691852685508492018742056806354"]},"id":"CVE-2026-45083-7c8b7eb3","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705"},{"id":"CVE-2026-45083-98ae9e70","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/exceptions/WebApplicationExceptionMapper.java"},"deprecated":false,"digest":{"line_hashes":["37994138628365580818974758186430730237","336097446975874563013620615906107221310","181589824107021635345717596750967050324","209226835474186640773004380408016702267","184664570515519214012649523436593972899","55739776980877502529317574108705201534","286486254576331906607509025346215854439","56384913244188273656560338990378843523","80744560735480719522374369104574823780","196408474155785843637456662616803344940","224119143608238160339494619790506364572","241517635703436399419254434762906265995","207722839877488270298795676777878309973","95768834001620177031708238090023627203","20659064345847270767002323090146916970","81594640191611771370451558992325936878","10338391066525703494694011886552239730","309077321070331900308975678740477993243"],"threshold":0.9}},{"id":"CVE-2026-45083-99ea9115","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/index/IndexResource.java","function":"stream"},"deprecated":false,"digest":{"length":421,"function_hash":"295479894629216671341605700160641192398"}},{"id":"CVE-2026-45083-ab748930","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/11fcd87f6ab77ecbc7e007bace50ad0ad26abe65","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/model/viewer/ViewManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["255404431327691725090813075088875353901","138252742407636352767436190537800926676","32451904890330959393777603701713158420","153537547462027169165228138034334005091","282112359935950846035688873073703859487","76178200390509236812346487893154487905","190486816839446653219825495485200738612","72633972666464812269281660266028993827","264656293286875011253909005676123933415","39154607673231684412816816073124749755","98793047741133829128241198777886967523","336054604227586502994754904793235161331","46136380838223735422358866657420836306","40283686628758778098113769928769056163","163419567423454430457007053728690132109","39186502506999097889464320713980219205","138453494805432100207690093596040891987","246358872193600584186431804357416262402"]}},{"id":"CVE-2026-45083-af5edf39","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/index/IndexResource.java"},"deprecated":false,"digest":{"line_hashes":["214693707921729766733868365961151650503","108483771915841486229956621962499198697","162854028198062842812116970654346097129","165432204933019119974370200032629961339","302714361518636868328226918186002314691","191015156121903676292394064941515917492","163086352091579376912259826540501654841","75886038384412345601161280191353929016","331887360825345649012148637281717463769","195437208442017332094090783089380623545","271972511558188058835137712702062078531","286482039376494425959140835511854081800","188730786013027324642969797761301248149","47560734905704875010523887043095485698","281943780143235429367666234139905205153","285697111843546592400982497058147399227","163633841055834486849259395972538311518","109535328207600858467907156416733518691","15501729799953211655729744066287095049","135811754993592110741114886336890481780","171018530139201033336508538329401033961","332059978888591077249679768208631338193","135534142270017826775435291521238190171","305364902136835628138330944725333471656","123203361356924353227900880165971594507","35155455071904663289776930586203467589","68334792945573170279356943720741936433","290527501479822423680102452048519469749","166178242033311509692669988432727221136","152191802885519786894887767539495590170","189593984067299417181717235302981220060","88702226390214521548815395474462081750","147114584200260130871493656541409665418","283249488980590618699592971281812948038","257571962262144686148264052106195718247","308636415690820567938965666412043283332","271087481820138960377872576821591244087","257431695967648325574752301113300386738","309916343360856460119862380438364575938","46314315501333305792196997157532903297","139370789143507434079887114108340029291","99664826918608267978867313838543706977","40566158756733699852664689114009521391","260149576791350059107610670583537543334","201657462002823748828698761006521009786","96407793939680543580727128440518872928","20960841443341598430000576742375463667","227956833216326501938217882958477906806","268963042845630537863416776200446312119","323765764708988059437558984615800620706","261276974225151594661867323040987420695","94719115511635032590727349565175839240","234145251107970555390734236634137694993","7861802526485476686066909057627903430","135404450146177667042586947862816562285","150949725474573564187237985580650483011","338658958347553768264930487716280546089","66172321481654973472901914979800992393","263258439330584562957158083313819355479","151667667938557072982160789326590688875","222569884710723225949669482505014720665","149099644219553073534342811939035759424","92759770477514561433122934046885527762","169705987354987531165290178390338239341","52779852148249686346155555612880606745","1488073000117298275451347856392996675","135631690228908907420678881597788939419","305746435259157724650149644540753117048","154996008022558467073077852958705928838","30047756581856817491175261334936423822","240739259017383368596219941588766825609","17438039970202193232998739721758511034","245604267887862826568404168985220371420","338150776734343611927254040697787804415","109165288300297774603114775643786413922","6865144473247393001833302216822201177"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"128001898279456780891002434808507632277","length":788},"id":"CVE-2026-45083-c18f3a8c","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd","target":{"function":"executeStreamingExpression","file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/index/IndexResource.java"}},{"deprecated":false,"digest":{"length":1371,"function_hash":"136920701389202348067402124046576244263"},"id":"CVE-2026-45083-c3d10044","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/11fcd87f6ab77ecbc7e007bace50ad0ad26abe65","target":{"function":"getImageInfos","file":"goobi-viewer-core/src/main/java/io/goobi/viewer/model/viewer/ViewManager.java"}},{"id":"CVE-2026-45083-c4242332","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705","target":{"function":"testStatistics","file":"goobi-viewer-core/src/test/java/io/goobi/viewer/api/rest/v1/index/IndexResourceTest.java"},"deprecated":false,"digest":{"function_hash":"173808629952963109314384194115370607943","length":574}},{"source":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/index/IndexResource.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["100599350770896952471487453598103410723","207421836804492865622624989700280657962","222504059749610858123737584156403296123","142587185571500125210984004217125794883","179581026477821052459440215089692907148","42412005904802213185269323312139730164","208078317462808744007852644966772009035","256323604398615045224725598626940874412","37063882601847789311193451114584431830","180449660640984208278513257429089903554","17823729773056672157990127056509776558","147905530597785230478057532371138716698","248150427948824033023399485259213079565","299000364599636355816221910856984419617","5244262067305840389556451113199881560","75216959755898595121244969226406639491","314564009053142899527800196726346420709","326501834751140390770863493434456675108","138968265313967304510281545902263735364","226045980109727889089731304897781782506","70149292781470769185830879277428479217","300986359276582651458096931868960863562","318848161549580779907864703513953946460","194568439412947368423538170098726341587","315318019829637795134335653632872200467","28996541346546514733394888618284672767","180058239122017028643197432519929837677","168747240648566507647269546490981214170","27779258620861409573231055021795076009","83016285122986045032959430173024516365","178342959755807394192940992366344184712","42805096046366353243646453149012857160","74067938574646743107864528386988191858","10204014632400760525397699326847891975","94117997212364731507117066562889911157","260147248809653577695101547577368730105","315534757556891589647527219879516511563","103718115522658500888606023717001114676","208115784104243522829172484235596323007","87274700951857287288593361307187129909","215940993371493515401732970591057034155"]},"id":"CVE-2026-45083-d1501b6c","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["194918379709690860414886676539982343494","212348215694632986987528474126307411834","254331884712082152543641963216129880153","221723523874761787810564936005566446892","175441706351275964055662272454333730975","129366774450755548297683151603582097531"]},"id":"CVE-2026-45083-f95d960a","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/index/IndexerResource.java"}},{"digest":{"function_hash":"27699485243766476706651909264606535096","length":663},"id":"CVE-2026-45083-fe31b7d0","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705","target":{"file":"goobi-viewer-core/src/test/java/io/goobi/viewer/api/rest/v1/index/IndexResourceTest.java","function":"testInvalidQuery"},"deprecated":false}],"vanir_signatures_modified":"2026-10-28T11:11:00Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}