CVE-2026-55178

GeoLens, a self-hosted geospatial data catalog, contains a broken access control flaw (prior to version 1.2.3) where read and link endpoints authorize only the resource named in the URL but fail to re-authorize a second caller-influenced dataset reached through relationships, map layers, VRT sources, externalId lookups, or request bodies. Unauthenticated attackers can abuse public maps via GET /maps/{id} and GET /maps/{id}/style. to read private layer metadata, sampled values, or vector tiles, and the style response can leak a replayable HMAC tile URL bound to neither a user nor a map. Anonymous callers can also enumerate dataset relationships to read rows from private target tables, and use GET /collections/datasets/items with an externalId UUID to fetch metadata for any private, restricted, or unpublished dataset with no visibility check. Authenticated default-role editors can additionally mosaic another user's private raster into an owned VRT and read its pixels, or call the POST /ai/metadata endpoints with an arbitrary body-controlled dataset_id to obtain private metadata and sample values. Disclosed data includes vector geometries and attributes, raster pixels, table rows, schemas, feature counts, extents, source URLs, filenames, contacts, and sampled row values; exploitation in the wild is not known and no public PoC exists.

What to do: Upgrade GeoLens to version 1.2.3 or later, where all affected endpoints re-authorize related datasets. Audit logs for anonymous or low-privilege access to /maps/{id}, /maps/{id}/style., /collections/datasets/items (externalId lookups), dataset relationship APIs, and /ai/metadata/* endpoints; rotate HMAC tile URL signing secrets if any style. responses were served publicly. Review datasets referenced by public maps and pre-existing vrt_source_links for unintended disclosure of private layers and member metadata.