Authorization Flaw in GeoLens Geospatial Data Catalog Affects Multiple Versions

CVE-2026-55178

What is CVE-2026-55178?

GeoLens is vulnerable due to its failure to properly authorize requests for protected resources. Prior to version 1.2.3, multiple API endpoints allowed unauthorized access to private datasets through certain relationship paths and request mechanisms. Anonymous users could exploit GET requests to access sensitive metadata and sampled values for private layers linked to public maps. Moreover, with insufficient visibility checks, it was possible for authenticated users to mosaic private raster data into their own VRTs and return private metadata. This oversight poses significant risks, allowing unauthorized disclosure of vector geometries, raster pixels, and additional sensitive data. The latest version addresses these vulnerabilities.

References