Insecure Direct Object Reference in GeoPulse Software from Tess1o

CVE-2026-129467

What is CVE-2026-129467?

GeoPulse versions 1.5.0 through 2.3.0 are vulnerable to an insecure direct object reference (IDOR) exploitation. This flaw exists in the API endpoint /api/v1/places/geocoding/{id}, enabling authenticated users to gain unauthorized access to other users' private location data. By enumerating the sequential reverse_geocoding_location IDs, an attacker can extract sensitive information such as custom place names, cities, countries, coordinates, and bounding boxes from the user history, compromising user privacy and security.

References