PT-2026-80761 · Geolens · Geolens

CVE-2026-55178

·

Published

2026-08-18

·

Updated

2026-08-19

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions GeoLens versions prior to 1.2.3
Description Multiple read and link endpoints fail to re-authorize secondary datasets accessed through relationships, layer references, mosaic sources, or request bodies. This allows users to access data from datasets they are not authorized to view, including vector tile data, raster pixels, backing-table rows, and metadata such as column schemas and sampled row values. Some instances allow anonymous access, while others require the default editor role.
Technical details include:
  • Endpoints GET /maps/{id} and GET /maps/{id}/style.json leak private dataset metadata and replayable HMAC signatures for vector tiles.
  • Dataset FK-relationship APIs allow anonymous callers to read rows from private target backing tables.
  • The endpoint GET /collections/datasets/items?externalId=<uuid> allows anonymous metadata disclosure via the externalId parameter.
  • Authenticated users with the editor role can disclose private raster pixels by mosaicking them into a VRT they own.
  • Endpoints POST /ai/metadata/{summary,keywords,lineage,quality-statement} allow users with the editor role to disclose any dataset's metadata and sample values via the dataset id variable in the request body.
  • Legacy vrt source links may leak member metadata and health status.
Recommendations Upgrade to GeoLens version 1.2.3. Restrict network exposure of the API and avoid co-locating private datasets with public maps or relationships as a temporary measure.

Fix

IDOR

Missing Authorization

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-639CWE-862CWE-200

Related Identifiers

CVE-2026-55178
GHSA-P23G-MVHJ-JH3J
PYSEC-2026-3662
PYSEC-2026-3663

Affected Products

Geolens