CVE-2026-55457

HighCVSS 7.4/10Last modified Oct 23, 2026

Description

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287 CWE-1392

Affected software

No affected versions have been published.

Timeline

Published: Oct 23, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-554597.4The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version CVE-2026-55466.3A flaw has been found in Campcodes Complete Online Learning Management System 1.0. This impacts the function add_lesson of the file /applica CVE-2026-554607.1Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but withou CVE-2026-554616.1Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled CVE-2026-554624.3Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing CVE-2026-554636.5The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version CVE-2026-554645.4Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Mar CVE-2026-554655.3The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version CVE-2026-554668.7Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image CVE-2026-554672.5OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob opt CVE-2026-554684.3Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective r CVE-2026-554696.5Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place