CVE-2026-46651
The Goobi viewer is a web application that allows digitised material to be displayed in a web…
- Risk score
- 74/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.7%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Goobi viewer's DownloadTaskEndpoint WebSocket endpoint accepts download requests from unauthenticated users in versions 24.03 to 26.04, allowing an attacker to potentially gain high privileges, perform high impact actions, and access high confidentiality data.
- Affected
- {'products': ['Goobi viewer'], 'packages': [], 'versions': ['24.03', '26.04']}
- Fix
- Upgrade to version 26.05 or later
- Exploitation
- No known exploitation
Not confirmed. 26.04 isn't in the advisory. Check the vendor's advisory before acting on this.
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
- https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5
- https://github.com/intranda/goobi-viewer-core/commit/b8943ee963e2aa1131da2212eaf85c5a2d90214f
- https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-79jg-3m2m-jgc8
Original description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
Last activity 23 Oct 2026. Patch Forecast updates every hour.