Vulnerability Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492f
- https://github.com/intranda/goobi-viewer-core/commit/b8943ee963e2aa1131da2212eaf
- https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-79jg-3m2m
FAQ
What is CVE-2026-46651?
CVE-2026-46651 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/d...
How severe is CVE-2026-46651?
CVE-2026-46651 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-46651?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.