High, CVSS 7.5PyPIPublished
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
CVE-2026-55178 · GHSA-p23g-mvhj-jh3j
- Affected
- PyPI geolens-cli < 1.2.3
- Fixed in
- 1.2.3· Vendor fix available
- Issue
- Multiple GeoLens read/link endpoints authorized only the resource named in the request URL (a map, a VRT, a source dataset, an AI request) and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or request body. This "authorize the URL resource, read a different dataset un-re-authorized" pattern let callers read data from datasets they have no access to. The most severe instances require no authentication at all (anonymous, network-only). Others require only the default editor role that any self-service signup / upload user receives. All issues are fixed in 1.2.3. There is no complete configuration workaround — upgrading is the only full remediation. Impact Depending on the endpoint, an attacker can read, for datasets they cannot otherwise access: - the dataset's vector tile data (actual feature geometries/attributes), - the dataset's raster pixels, - backing-table rows, - and metadata —…
Recommended action: Upgrade to 1.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.