Is CVE-2026-55444 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55444 being exploited in the wild.

How severe is CVE-2026-55444?

Medium severity, with a CVSS score of 5.3, published 23 October 2026.

Which products and versions are affected?

Intranda Goobi viewer before 26.05.

Is there a fix for CVE-2026-55444?

Yes: fixed in 26.05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55444 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55444?

Check whether you run Intranda Goobi viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55444: Goobi viewer Solr injection in RSS servlet

CVE-2026-55444 · Severity: medium · CVSS 5.3 · Published 2026-10-23

Goobi viewer is a web application that displays digitized library materials and archives in a web browser. Its legacy RSS feed servlet fails to validate user input before passing it to Solr search queries, allowing attackers to inject operators that bypass access restrictions. An unauthenticated attacker can craft a malicious RSS request to expose restricted or confidential digitized documents that should not be publicly visible.

Technologies: Intranda Goobi viewer. Vendors: Intranda.

Quick answers

Is CVE-2026-55444 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55444 being exploited in the wild.
How severe is CVE-2026-55444?: Medium severity, with a CVSS score of 5.3, published 23 October 2026.
Which products and versions are affected?: Intranda Goobi viewer before 26.05.
Is there a fix for CVE-2026-55444?: Yes: fixed in 26.05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55444 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55444?: Check whether you run Intranda Goobi viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.05

Technical details

The RssResolver servlet's GET /rss/ endpoint concatenates unauthenticated q and filterQuery parameters into Solr queries without validation, whereas the newer REST API layer (GET /api/v1/records/rss) performs proper input validation. An attacker can inject Solr boolean operators to break out of the wrapping parentheses and render the trailing access-condition filter-query suffix optional, causing the Solr query to return access-restricted records. The vulnerability affects versions before 26.05.

Affected products

intranda Goobi viewer before 26.05

Timeline

2026-10-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.