25 matches found
CVE-2026-55178
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...
EUVD-2026-78775
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...
CVE-2026-55178 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...
CVE-2026-55178
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...
CVE-2026-55178 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...
CVE-2026-55178
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC/STAC APIs, and a map builder. Prior to 1.2.3 , multiple read and link endpoints authorized only the resource named in the request URL but failed to re-authorize a second caller-influenced dataset reached through a relation...
CVE-2026-55178 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...
CVE-2026-55178: Exposure of Sensitive Information to an Unauthorized Actor
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...
GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)
GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain data and metadata for datasets they are not authorized to access. Impact - Private record metadata disclosure. Record contact, keyword, and distribution sub-resource endpoints...
GHSA-P77J-G7H5-R2VW GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)
GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain data and metadata for datasets they are not authorized to access. Impact - Private record metadata disclosure. Record contact, keyword, and distribution sub-resource endpoints...
Use of Cache Containing Sensitive Information
Overview geolens is an Auto-generated Python SDK for the GeoLens API. Typed clients with Bearer + API-key auth helpers. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information inadequate authorization checks and improper cache control in multiple endpoint...
PYSEC-2026-3663 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...
PYSEC-2026-3662 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
SummaryMultiple GeoLens read/link endpoints authorized only the resource named in therequest URL a map, a VRT, a source dataset, an AI request and failed tore-authorize a second, caller-influenced dataset that the request reachedthrough a relationship, layer reference, mosaic source, or request...
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
SummaryMultiple GeoLens read/link endpoints authorized only the resource named in therequest URL a map, a VRT, a source dataset, an AI request and failed tore-authorize a second, caller-influenced dataset that the request reachedthrough a relationship, layer reference, mosaic source, or request...
PT-2026-83512
GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain data and metadata for datasets they are not authorized to access. Impact - Private record metadata disclosure. Record contact, keyword, and distribution sub-resource endpoints...
PT-2026-80639
Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...
PT-2026-80638
Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...
Missing Authorization
Overview @geolens/sdk is an Auto-generated TypeScript SDK for the GeoLens API. Typed clients with Bearer + API-key auth helpers. Affected versions of this package are vulnerable to Missing Authorization inadequate authorization checks on cross-dataset references in multiple API endpoints. An...
GHSA-P23G-MVHJ-JH3J GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...