CVE-2026-46651

LOWCVSS 9.8 · CRITICAL

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-306CWE-552CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

Cordoba@cordobahq16h
CVE-2026-46651 (CVSS 9.8): the DownloadTaskEndpoint WebSocket endpoint in goobi-viewer-core accepts download requests from unauthenticated users. Affects Goobi viewer 24.03 to before 26.05. Fixed in 26.05. Source: NVD
0000012
13 followersView on X

Explore more

Back to dashboard