# CVE-2026-55465: Goobi viewer Solr injection in spatial search endpoint

Source: https://junglewise.ai/threats/cve-2026-55465-the-goobi-viewer-is-a-web-application-that-allows-digitised  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-55465 · Severity: medium · CVSS 5.3 · Published 2026-10-23

Goobi viewer is a web application that displays digitized documents and materials in browsers. An unauthenticated attacker can inject malicious Solr query syntax into the spatial search endpoint to bypass access controls and view restricted records that should not be accessible to them.

Technologies: [Intranda Goobi viewer](https://junglewise.ai/threats/technologies/goobi-viewer). Vendors: [Intranda](https://junglewise.ai/threats/vendors/intranda).

## Quick answers

**Is CVE-2026-55465 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55465 being exploited in the wild.

**How severe is CVE-2026-55465?** Medium severity, with a CVSS score of 5.3, published 23 October 2026.

**Which products and versions are affected?** Intranda Goobi viewer 22.04 to before 26.05.

**Is there a fix for CVE-2026-55465?** Yes: fixed in 26.05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55465 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55465?** Check whether you run Intranda Goobi viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.05

## Technical details

The REST endpoint GET /api/v1/index/{solrField}/spatial/search fails to escape or validate the user-supplied region query parameter before concatenating it into a Solr query string. An attacker can inject Solr local-param syntax ({!parent}, {!join}) and boolean operators to bypass access-condition filters. The vulnerability requires no authentication and affects versions 22.04 through before 26.05.

## Affected products

- intranda Goobi viewer 22.04 to before 26.05

## Timeline

- 2026-10-23: disclosed

## References

- [https://github.com/intranda/goobi-viewer-core/commit/46fb8759caa91b5ba9f0c387e5a0d0d3875bf633](https://github.com/intranda/goobi-viewer-core/commit/46fb8759caa91b5ba9f0c387e5a0d0d3875bf633)
- [https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05](https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05)

## Related threats

- [Goobi viewer reflected XSS in IIIF Auth endpoints](https://junglewise.ai/threats/cve-2026-55486-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass in OpenID token validation](https://junglewise.ai/threats/cve-2026-55459-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass via empty API token](https://junglewise.ai/threats/cve-2026-55457-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr injection in RSS servlet](https://junglewise.ai/threats/cve-2026-55444-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr query injection via regex bypass](https://junglewise.ai/threats/cve-2026-55442-the-goobi-viewer-is-a-web-application-that-allows-digitised)