GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

🗓️ 19 Aug 2026 11:56:27Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 2 Views

GeoLens pre-1.2.3 authorization bypass leaks private dataset metadata, tiles, rows, and raster data to anonymous or editor-role users.

Reporter	Title	Published	Views	Family All 6
CVE	CVE-2026-55178	18 Aug 202618:00	–	cve
Github Security Blog	GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data	18 Aug 202618:00	–	github
OSV	GHSA-P23G-MVHJ-JH3J GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data	18 Aug 202618:00	–	osv
OSV	PYSEC-2026-3662 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data	19 Aug 202611:56	–	osv
OSV	PYSEC-2026-3663 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data	19 Aug 202611:56	–	osv
PyPA	GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data	19 Aug 202611:56	–	pypa

Vulners

Node

pypi geolensRange0–1.2.3

Source	Link
github	www.github.com/geolens-io/geolens/security/advisories/GHSA-p23g-mvhj-jh3j
github	www.github.com/geolens-io/geolens/pull/234
github	www.github.com/geolens-io/geolens/pull/235
github	www.github.com/geolens-io/geolens/pull/236
github	www.github.com/geolens-io/geolens/pull/237
github	www.github.com/geolens-io/geolens/pull/238
github	www.github.com/geolens-io/geolens
pypi	www.pypi.org/project/geolens
github	www.github.com/advisories/GHSA-p23g-mvhj-jh3j
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-55178

19 Aug 2026 12:16Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.17.5