CVE-2026-55444: CWE-20: Improper Input Validation in intranda goobi-viewer-core

The Goobi viewer's legacy RSS servlet (RssResolver, GET /rss/) prior to version 26.05 accepts the q and filterQuery parameters and concatenates them directly into Solr queries without validation. The q parameter forms the main query body wrapped only in literal parentheses, while filterQuery is passed directly as a Solr filter query. Due to lack of input validation, an unauthenticated attacker can inject Solr boolean operators to break out of the query wrapping and bypass access-condition filters, causing access-restricted records to be included in the RSS feed. The vulnerability affects both parameters but q has a broader scope. The issue was resolved in version 26.05.

An unauthenticated attacker can exploit this vulnerability to bypass access restrictions and retrieve access-restricted records via the RSS feed. The confidentiality of restricted digitised material may be compromised. There is no impact on integrity or availability reported. The CVSS v3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

This vulnerability has been patched in intranda goobi-viewer-core version 26.05. Users should upgrade to version 26.05 or later to remediate this issue. No additional mitigations are indicated by the vendor advisory.