Goobi Viewer Unauthenticated Download Access Vulnerability

Goobi viewer, a web application for displaying digitised material in a browser, contains a missing-authentication vulnerability in its download task endpoint.

From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users.

• Affected versions: 24.03 through versions before 26.05
• Affected component: goobi-viewer-core DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket)
• Impact: unauthenticated users can submit download requests

This issue has been patched in version 26.05.