CVE-2026-55178
Received Received - Intake

GeoLens Unauthorized Data Exposure via API Endpoints

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a relationship, map layer, VRT source, externalId lookup, or request body. When a public map references a private dataset, anonymous callers can use GET /maps/{id} and GET /maps/{id}/style.json to obtain the private layer's metadata, sampled values, or vector tiles. The style response can expose a replayable HMAC tile URL that is bound to neither a user nor a map. When a public source dataset has a relationship to a private target dataset, anonymous callers can use the dataset relationship APIs to enumerate the relationship and read rows from the private target's backing table. Anonymous callers can also use GET /collections/datasets/items with an externalId dataset UUID to obtain metadata for any private, restricted, or unpublished dataset because that lookup performs no visibility check. Authenticated users with the default editor role can mosaic another user's private raster into an owned VRT and read its pixels, and POST /ai/metadata/{summary,keywords,lineage,quality-statement} accepts a body-controlled dataset_id without a visibility check and returns private metadata and sample values. Pre-existing vrt_source_links also expose unauthorized member metadata and health unless each member is filtered at read time. These paths can disclose vector geometries and attributes, raster pixels, table rows, table names, column schemas, feature counts, extents, source URLs and filenames, contacts, and sampled row values. This issue is fixed in version 1.2.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55178
EUVD
EUVD-2026-78775

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
geolens geolens 1.2.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GeoLens before version 1.2.3 has an authorization flaw where endpoints like GET /maps/{id} and GET /maps/{id}/style.json only check map-level access. This allows anonymous users to access private dataset metadata through public maps, including table names, column schemas, feature counts, extents, sampled row values, and replayable HMAC tile URLs. Relationship APIs and externalId lookups also expose private dataset details without proper visibility checks.

Detection Guidance

To detect this vulnerability, check if your GeoLens instance is running a version prior to 1.2.3. Verify access logs for unauthorized requests to endpoints like GET /maps/{id}, GET /maps/{id}/style.json, GET /collections/datasets/items, or POST /ai/metadata/{summary,keywords,lineage,quality-statement}. Look for attempts to access private dataset metadata or vector tiles by unauthorized users.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive geospatial data, including vector geometries, raster pixels, table rows, and metadata. Attackers could exploit it to extract private dataset information, such as source URLs, filenames, contacts, and sampled values, even when datasets are marked as private or restricted.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive geospatial data, including personally identifiable information (PII) or protected health information (PHI), if such data is stored in private datasets. This violates GDPR's data protection principles (Article 5) and HIPAA's access controls (45 CFR § 164.312(a)(1)), potentially resulting in data breaches and non-compliance penalties.

Mitigation Strategies

Upgrade GeoLens to version 1.2.3 or later immediately. Review and restrict access to sensitive endpoints. Ensure all dataset visibility checks are enforced at read time. Audit logs for any signs of exploitation and revoke any exposed HMAC tile URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55178. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart