Executive Summary
CVE-2026-46651 is a critical missing-authentication flaw (CWE-306) in goobi-viewer-core, the web application component of intranda's Goobi viewer used by libraries, archives, and museums to present digitised material in a browser. The DownloadTaskEndpoint WebSocket at /tasks/download/monitor.socket accepts download requests from unauthenticated users.
CVSS Score: 9.8 (Critical)
Public analyses describe the impact as unauthenticated server-side request forgery (SSRF) and local file inclusion. The issue was published on 2026-10-23 and is fixed in version 26.05. No public exploit and no confirmed in-the-wild exploitation were listed at the time of writing.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-46651 |
| CVSS Score | 9.8 (Critical) |
| Weakness | CWE-306 Missing Authentication for Critical Function (related: CWE-552, CWE-918) |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Affected Component | DownloadTaskEndpoint WebSocket (/tasks/download/monitor.socket) |
| Patch Available | Yes — goobi-viewer-core 26.05 |
| Known Exploited | Not reported |
Affected Products
| Product | Affected Versions | Fixed Version |
|---|---|---|
| intranda goobi-viewer-core | 24.03 up to (not including) 26.05 | 26.05 |
Technical Analysis
The WebSocket endpoint used to monitor and start download tasks performs no authentication or authorization check. Because the task accepts a source to fetch, an anonymous client can make the server retrieve resources on its behalf, reaching internal-only services (SSRF) or files on the host (local file inclusion), depending on the deployment.
Goobi viewer instances are frequently internet-facing by design, since they publish digital collections to the public. That makes an unauthenticated endpoint on the application's own web tier particularly exposed.
Impact Assessment
| Impact Area | Description |
|---|---|
| Internal Network Access | Server can be coerced into requesting internal services and cloud metadata endpoints |
| File Disclosure | Local files readable by the application account may be exposed |
| Credential Exposure | Configuration files and tokens on the host may leak |
| Pivoting | SSRF reachability can support further lateral movement |
Immediate Remediation
- Upgrade goobi-viewer-core to 26.05 or later.
- If you cannot upgrade immediately, block external access to
/tasks/download/monitor.socketat the reverse proxy or WAF. - Restrict egress from the viewer host so it cannot reach internal management networks or cloud metadata addresses.
- Run the viewer under a least-privilege account with no access to unrelated secrets.
# Temporary mitigation: deny the vulnerable WebSocket path at the proxy
location /tasks/download/monitor.socket {
deny all;
}Detection Indicators
| Indicator | Description |
|---|---|
WebSocket upgrade requests to /tasks/download/monitor.socket from unauthenticated clients | Exploitation attempt |
| Outbound requests from the viewer host to internal ranges or metadata IPs | SSRF activity |
| Unexpected reads of configuration files by the application process | File inclusion |