Junglewise Threat Intelligence

CVE-2026-55178: GeoLens cross-dataset authorization bypass in map, relationship, and AI endpoints

CVE-2026-55178 · Severity: high · CVSS 7.5 · Published 2026-08-18

Executive brief

GeoLens is a geospatial data platform that manages vector/raster datasets, maps, and relationships between datasets. Multiple API endpoints fail to re-authorize second-party datasets accessed through relationships, map layers, or request parameters, allowing attackers to read private dataset metadata, schema, sample values, table rows, and tile imagery. The most severe issues require no authentication and expose sensitive geospatial data and database structure to any network-connected attacker.

Technical details

This vulnerability comprises six distinct authorization-bypass issues across map, relationship, OGC catalog, VRT/mosaic, and AI metadata endpoints. The root cause is a pattern where endpoints authorize only the resource named in the URL (map ID, VRT ID, dataset ID) but fail to re-authorize secondary datasets reached through relationships, layer references, mosaic membership, or request body parameters. Findings 1–3 and 6 are unauthenticated (network-only); findings 4–5 require authentication with the default "editor" role. Attackers can (1) extract vector tile signatures and replay them to read private geometries/attributes from public maps, (2) enumerate relationships to private datasets and read backing table rows, (3) lookup any dataset by UUID to retrieve full OGC metadata without visibility checks, (4) mosaic unauthorized private rasters into attacker-owned VRTs and read pixels, (5) submit arbitrary dataset_id values to AI endpoints to leak sample values and schema, and (6) access legacy VRT source member metadata via pre-existing links. Patches in 1.2.3 add per-dataset re-authorization checks at both write-time (link/mosaic operations) and read-time (tile/record/metadata endpoints).

Affected products

  • GeoLens GeoLens API < 1.2.3
  • GeoLens @geolens/sdk (npm) < 1.2.3
  • GeoLens geolens (pip) < 1.2.3
  • GeoLens geolens-cli (pip) < 1.2.3

Timeline

  • 2026-08-18: disclosed: Published to GitHub Advisory Database
  • 2026-08-18: patched: Version 1.2.3 released with fixes

References

Related threats