IT Security 1 month ago

CVE-2026-55178 – GeoLens Authorization Bypass Allows Data Leakage

GeoLens < 1.2.3 suffers an authorization bypass that lets attackers harvest private map layers, raster data, and dataset metadata. Upgrade to 1.2.3 to close the gap. GeoLens < 1.2.3 suffers an authorization bypass that lets attackers harvest private map layers, raster data, and dataset metadata. Upgrade to 1.2.3 to close the gap.

FacebookXReddit

IT Security

Executive summary

GeoLens versions prior to 1.2.3 contain an authorization bypass that trusts only the resource named in the request URL. Attackers can traverse relationships, map layers, VRT sources, externalId lookups, or request bodies to access private datasets. The flaw enables disclosure of vector geometries, raster pixels, table rows, and other sensitive metadata. The issue is addressed in version 1.2.3.

What is affected

  • GeoLens self‑hosted geospatial data catalog.
  • All releases earlier than 1.2.3 (specific version numbers not listed).

Severity and evidence

  • No CVSS score or formal severity rating is provided in the NVD entry.
  • Evidence from the vendor description shows multiple endpoints that bypass visibility checks, leading to unauthorized data exposure.

Business or operational impact

  • Confidential geospatial datasets (private layers, raster imagery, attribute tables) can be harvested by anonymous users or low‑privilege accounts.
  • Potential breach of privacy regulations, loss of intellectual property, and reputational damage for organizations that rely on GeoLens to protect sensitive spatial data.

Detection considerations

  • Monitor access logs for unauthenticated GET requests to /maps/{id} and /maps/{id}/style.json on maps marked public.
  • Look for unusual calls to /collections/datasets/items with an externalId parameter from anonymous IPs.
  • Audit usage of the dataset relationship APIs and VRT source links for unexpected cross‑dataset reads.
  • Flag POST requests to /ai/metadata/* that include a dataset_id not owned by the caller.

Recommended defensive actions

  1. Upgrade immediately to GeoLens 1.2.3 or later, where the authorization checks are corrected.
  2. Restrict anonymous access to map and dataset endpoints until the upgrade is applied.
  3. Review and tighten role‑based permissions; consider limiting the default editor role’s ability to create VRT mosaics.
  4. Disable or tightly control externalId lookups if they are not required.
  5. Implement network segmentation or firewall rules to limit exposure of GeoLens APIs to trusted networks.

Workarounds or mitigations, if supported

  • If upgrading is not feasible, configure GeoLens to make all maps private and require authentication for /maps/* and related style endpoints.
  • Remove or hide public references to private datasets in map definitions.
  • Manually validate and filter VRT source links and relationship definitions to ensure they do not point to restricted datasets.
  • Turn off the /ai/metadata/* endpoint or enforce strict server‑side validation of dataset_id values.

Patch or remediation status

  • The vulnerability is fixed in GeoLens version 1.2.3. No additional patches are listed.

References

  • NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-55178

Publication date and last checked date

  • Publication date: 2026‑09‑17
  • Last checked: 2026‑09‑18

← Back to IT Security