CVE-2026-45083
- Source
- https://cve.org/CVERecord?id=CVE-2026-45083
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45083.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-45083
- Aliases
- Published
- 2026-05-27T21:00:52Z
- Modified
- 2026-10-28T11:11:00Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Goobi viewer: Unauthenticated Solr Streaming Expression Proxy
- Details
-
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to before 26.04.1, the Goobi viewer REST endpoint POST /api/v1/index/stream accepted an arbitrary Solr streaming expression from unauthenticated network clients and forwarded it to the backend Solr server without restriction. An attacker could read the complete Solr index and, in default Solr deployments, also modify or delete indexed records. This vulnerability is fixed in 26.04.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-306" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45083.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45083.json
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2rgp-f66f-4499
- https://nvd.nist.gov/vuln/detail/CVE-2026-45083
- https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd
- https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705
Affected packages
Git / github.com/intranda/goobi-viewer-core
Affected ranges
- Type
- GIT
- Repo
- https://github.com/intranda/goobi-viewer-core
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "4.8.0" }, { "fixed": "26.04.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "326980f24ce1e7cfabf658dd5f615934ca68ebbd" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "6bfb1cbd4250b0b347e84a80f38e8bf46acac705" } ], "source": "REFERENCES_COMMIT" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45083.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"150474910825043800925042562045539646203",
"330461506164452685956631063226949901359",
"189674573377580459489633979715769805174",
"201246636619232495684660704493068737566"
],
"threshold": 0.9
},
"id": "CVE-2026-45083-0ab338e9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/ApiUrls.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"147649039287009379201124742694435009194",
"282642399067807433916765889201611769188"
],
"threshold": 0.9
},
"id": "CVE-2026-45083-0ab65bc7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/controller/SolrSearchIndex.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "137176002298015012542001684821142168571",
"length": 379
},
"id": "CVE-2026-45083-182784b5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/Application.java",
"function": "init"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"224112869728488153170763395838288660106",
"55816821457579975625717129427551867408",
"262739788322982381379770151585304706607",
"156039991533206535474047709326837004318",
"17863637781455604026498255667097166358",
"18197384966580544179823653737962493407",
"58943501117570404940150397688632182112",
"271381584085701775270048568105244744066"
],
"threshold": 0.9
},
"id": "CVE-2026-45083-23566300",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/ApiUrls.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"89645250548511280395044743160637151414",
"114120601105245059007645173474156608583",
"85662344585535361973346744364576699463",
"324161798927002789337337568694236523125",
"272252394907840889700108155442585640508",
"256181522626460880698504362649762255526",
"85662344585535361973346744364576699463",
"324161798927002789337337568694236523125",
"97976962304026424413212184320566802558",
"126953845588067683560923077707354480068",
"202081755789817384204577304445759756000",
"269636789957495447677890876095594384439"
],
"threshold": 0.9
},
"id": "CVE-2026-45083-309baf44",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
"target": {
"file": "goobi-viewer-core/src/test/java/io/goobi/viewer/api/rest/v1/index/IndexResourceTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "164284937094511887642907859822000011393",
"length": 605
},
"id": "CVE-2026-45083-5914674b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
"target": {
"file": "goobi-viewer-core/src/test/java/io/goobi/viewer/api/rest/v1/index/IndexResourceTest.java",
"function": "testQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"208003071018981288522723960349252814173",
"140220513331696306766231299537324698349",
"120261153866251905882794794733719947684",
"137762447718151797418845777360455392848"
],
"threshold": 0.9
},
"id": "CVE-2026-45083-5ecb6149",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v2/ApiUrls.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "71703594554769232992558447542976968867",
"length": 1201
},
"id": "CVE-2026-45083-6fcfb205",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/exceptions/WebApplicationExceptionMapper.java",
"function": "toResponse"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"59342083027139869268762781898892015744",
"330061968672887990139865703301612805145",
"11064228913186787754069797393089061562",
"57068342373362429664095387340408178844",
"334058306613229031648642070445446261635",
"49798277691852685508492018742056806354"
],
"threshold": 0.9
},
"id": "CVE-2026-45083-7c8b7eb3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/Application.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"37994138628365580818974758186430730237",
"336097446975874563013620615906107221310",
"181589824107021635345717596750967050324",
"209226835474186640773004380408016702267",
"184664570515519214012649523436593972899",
"55739776980877502529317574108705201534",
"286486254576331906607509025346215854439",
"56384913244188273656560338990378843523",
"80744560735480719522374369104574823780",
"196408474155785843637456662616803344940",
"224119143608238160339494619790506364572",
"241517635703436399419254434762906265995",
"207722839877488270298795676777878309973",
"95768834001620177031708238090023627203",
"20659064345847270767002323090146916970",
"81594640191611771370451558992325936878",
"10338391066525703494694011886552239730",
"309077321070331900308975678740477993243"
],
"threshold": 0.9
},
"id": "CVE-2026-45083-98ae9e70",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/exceptions/WebApplicationExceptionMapper.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "295479894629216671341605700160641192398",
"length": 421
},
"id": "CVE-2026-45083-99ea9115",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/index/IndexResource.java",
"function": "stream"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"255404431327691725090813075088875353901",
"138252742407636352767436190537800926676",
"32451904890330959393777603701713158420",
"153537547462027169165228138034334005091",
"282112359935950846035688873073703859487",
"76178200390509236812346487893154487905",
"190486816839446653219825495485200738612",
"72633972666464812269281660266028993827",
"264656293286875011253909005676123933415",
"39154607673231684412816816073124749755",
"98793047741133829128241198777886967523",
"336054604227586502994754904793235161331",
"46136380838223735422358866657420836306",
"40283686628758778098113769928769056163",
"163419567423454430457007053728690132109",
"39186502506999097889464320713980219205",
"138453494805432100207690093596040891987",
"246358872193600584186431804357416262402"
],
"threshold": 0.9
},
"id": "CVE-2026-45083-ab748930",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/11fcd87f6ab77ecbc7e007bace50ad0ad26abe65",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/model/viewer/ViewManager.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"214693707921729766733868365961151650503",
"108483771915841486229956621962499198697",
"162854028198062842812116970654346097129",
"165432204933019119974370200032629961339",
"302714361518636868328226918186002314691",
"191015156121903676292394064941515917492",
"163086352091579376912259826540501654841",
"75886038384412345601161280191353929016",
"331887360825345649012148637281717463769",
"195437208442017332094090783089380623545",
"271972511558188058835137712702062078531",
"286482039376494425959140835511854081800",
"188730786013027324642969797761301248149",
"47560734905704875010523887043095485698",
"281943780143235429367666234139905205153",
"285697111843546592400982497058147399227",
"163633841055834486849259395972538311518",
"109535328207600858467907156416733518691",
"15501729799953211655729744066287095049",
"135811754993592110741114886336890481780",
"171018530139201033336508538329401033961",
"332059978888591077249679768208631338193",
"135534142270017826775435291521238190171",
"305364902136835628138330944725333471656",
"123203361356924353227900880165971594507",
"35155455071904663289776930586203467589",
"68334792945573170279356943720741936433",
"290527501479822423680102452048519469749",
"166178242033311509692669988432727221136",
"152191802885519786894887767539495590170",
"189593984067299417181717235302981220060",
"88702226390214521548815395474462081750",
"147114584200260130871493656541409665418",
"283249488980590618699592971281812948038",
"257571962262144686148264052106195718247",
"308636415690820567938965666412043283332",
"271087481820138960377872576821591244087",
"257431695967648325574752301113300386738",
"309916343360856460119862380438364575938",
"46314315501333305792196997157532903297",
"139370789143507434079887114108340029291",
"99664826918608267978867313838543706977",
"40566158756733699852664689114009521391",
"260149576791350059107610670583537543334",
"201657462002823748828698761006521009786",
"96407793939680543580727128440518872928",
"20960841443341598430000576742375463667",
"227956833216326501938217882958477906806",
"268963042845630537863416776200446312119",
"323765764708988059437558984615800620706",
"261276974225151594661867323040987420695",
"94719115511635032590727349565175839240",
"234145251107970555390734236634137694993",
"7861802526485476686066909057627903430",
"135404450146177667042586947862816562285",
"150949725474573564187237985580650483011",
"338658958347553768264930487716280546089",
"66172321481654973472901914979800992393",
"263258439330584562957158083313819355479",
"151667667938557072982160789326590688875",
"222569884710723225949669482505014720665",
"149099644219553073534342811939035759424",
"92759770477514561433122934046885527762",
"169705987354987531165290178390338239341",
"52779852148249686346155555612880606745",
"1488073000117298275451347856392996675",
"135631690228908907420678881597788939419",
"305746435259157724650149644540753117048",
"154996008022558467073077852958705928838",
"30047756581856817491175261334936423822",
"240739259017383368596219941588766825609",
"17438039970202193232998739721758511034",
"245604267887862826568404168985220371420",
"338150776734343611927254040697787804415",
"109165288300297774603114775643786413922",
"6865144473247393001833302216822201177"
],
"threshold": 0.9
},
"id": "CVE-2026-45083-af5edf39",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/index/IndexResource.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "128001898279456780891002434808507632277",
"length": 788
},
"id": "CVE-2026-45083-c18f3a8c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/index/IndexResource.java",
"function": "executeStreamingExpression"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "136920701389202348067402124046576244263",
"length": 1371
},
"id": "CVE-2026-45083-c3d10044",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/11fcd87f6ab77ecbc7e007bace50ad0ad26abe65",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/model/viewer/ViewManager.java",
"function": "getImageInfos"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "173808629952963109314384194115370607943",
"length": 574
},
"id": "CVE-2026-45083-c4242332",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
"target": {
"file": "goobi-viewer-core/src/test/java/io/goobi/viewer/api/rest/v1/index/IndexResourceTest.java",
"function": "testStatistics"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"100599350770896952471487453598103410723",
"207421836804492865622624989700280657962",
"222504059749610858123737584156403296123",
"142587185571500125210984004217125794883",
"179581026477821052459440215089692907148",
"42412005904802213185269323312139730164",
"208078317462808744007852644966772009035",
"256323604398615045224725598626940874412",
"37063882601847789311193451114584431830",
"180449660640984208278513257429089903554",
"17823729773056672157990127056509776558",
"147905530597785230478057532371138716698",
"248150427948824033023399485259213079565",
"299000364599636355816221910856984419617",
"5244262067305840389556451113199881560",
"75216959755898595121244969226406639491",
"314564009053142899527800196726346420709",
"326501834751140390770863493434456675108",
"138968265313967304510281545902263735364",
"226045980109727889089731304897781782506",
"70149292781470769185830879277428479217",
"300986359276582651458096931868960863562",
"318848161549580779907864703513953946460",
"194568439412947368423538170098726341587",
"315318019829637795134335653632872200467",
"28996541346546514733394888618284672767",
"180058239122017028643197432519929837677",
"168747240648566507647269546490981214170",
"27779258620861409573231055021795076009",
"83016285122986045032959430173024516365",
"178342959755807394192940992366344184712",
"42805096046366353243646453149012857160",
"74067938574646743107864528386988191858",
"10204014632400760525397699326847891975",
"94117997212364731507117066562889911157",
"260147248809653577695101547577368730105",
"315534757556891589647527219879516511563",
"103718115522658500888606023717001114676",
"208115784104243522829172484235596323007",
"87274700951857287288593361307187129909",
"215940993371493515401732970591057034155"
],
"threshold": 0.9
},
"id": "CVE-2026-45083-d1501b6c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/index/IndexResource.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"194918379709690860414886676539982343494",
"212348215694632986987528474126307411834",
"254331884712082152543641963216129880153",
"221723523874761787810564936005566446892",
"175441706351275964055662272454333730975",
"129366774450755548297683151603582097531"
],
"threshold": 0.9
},
"id": "CVE-2026-45083-f95d960a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/index/IndexerResource.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "27699485243766476706651909264606535096",
"length": 663
},
"id": "CVE-2026-45083-fe31b7d0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705",
"target": {
"file": "goobi-viewer-core/src/test/java/io/goobi/viewer/api/rest/v1/index/IndexResourceTest.java",
"function": "testInvalidQuery"
}
}
]
vanir_signatures_modified
"2026-10-28T11:11:00Z"