PYSEC-2026-3662 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

🗓️ 19 Aug 2026 11:56:27Reported by GoogleType

osv🔗 osv.dev👁 2 Views

GeoLens <1.2.3 authorization bypass lets anonymous or editor-role users read private dataset metadata, tiles, and table rows via un-re-authorized cross-dataset links.

Reporter	Title	Published	Views	Family All 6
CVE	CVE-2026-55178	18 Aug 202618:00	–	cve
Github Security Blog	GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data	18 Aug 202618:00	–	github
OSV	GHSA-P23G-MVHJ-JH3J GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data	18 Aug 202618:00	–	osv
OSV	PYSEC-2026-3663 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data	19 Aug 202611:56	–	osv
PyPA	GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data	19 Aug 202611:56	–	pypa
PyPA	GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data	19 Aug 202611:56	–	pypa

Source	Link
github	www.github.com/geolens-io/geolens/security/advisories/GHSA-p23g-mvhj-jh3j
github	www.github.com/geolens-io/geolens/pull/234
github	www.github.com/geolens-io/geolens/pull/235
github	www.github.com/geolens-io/geolens/pull/236
github	www.github.com/geolens-io/geolens/pull/237
github	www.github.com/geolens-io/geolens/pull/238
github	www.github.com/geolens-io/geolens
pypi	www.pypi.org/project/geolens
github	www.github.com/advisories/GHSA-p23g-mvhj-jh3j
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-55178

19 Aug 2026 12:55Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.17.5