Is CVE-2026-46651 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-46651?

CVE-2026-46651 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-46651

Description

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.