CVE-2026-55463: CWE-306: Missing Authentication for Critical Function in intranda goobi-viewer-core

The goobi-viewer-core web application contains multiple Jakarta WebSocket endpoints (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) that accept connections without authenticating the associated HttpSession or validating the Origin header against an allowlist. This missing authentication for critical functions (CWE-306) enables unauthenticated attackers to connect to these endpoints. Specifically, via the CampaignEndpoint, attackers can manipulate the in-process crowdsourcing page-lock map by broadcasting forged lock messages, disrupting the work of reviewers. The vulnerability affects versions >=4.11.0 and <26.05 and has been patched in version 26.05.

An unauthenticated attacker can connect to vulnerable WebSocket endpoints and disrupt the crowdsourcing page-lock mechanism by sending forged lock messages. This can interfere with reviewers' work by causing confusion or denial of coordination on locked pages. The confidentiality and integrity impacts are limited to partial control over the page-lock state, with no direct availability impact reported. The CVSS score is 6.5 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and limited confidentiality and integrity impact.

Upgrade goobi-viewer-core to version 26.05 or later, where this vulnerability has been patched. Until then, restrict access to the WebSocket endpoints through network controls if possible. There is no vendor advisory indicating alternative mitigations or that the issue is already mitigated.