GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

SummaryMultiple GeoLens read/link endpoints authorized only the resource named in therequest URL a map, a VRT, a source dataset, an AI request and failed tore-authorize a second, caller-influenced dataset that the request reachedthrough a relationship, layer reference, mosaic source, or request...