CVE-2026-129467

GeoPulse versions 1.5.0 through 2.3.0 are affected by an Insecure Direct Object Reference (IDOR) vulnerability in the GET /api/v1/places/geocoding/{id} endpoint. This flaw allows authenticated users to access other users' private location data by enumerating sequential reverse_geocoding_location ...