vulnerability / NVI-00015098 / Revision 1
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
GitHub lists this reviewed advisory for @geolens/sdk, geolens-cli, geolens. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.
This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.
01 / Meaning
Why it matters
Published affected context helps an owner decide what evidence to gather. This report has not examined your application.
7.5 high
GitHub source severity; exploitability and local consequence require separate evidence.
As of · GitHub Advisory Database
02 / Applicability
The affected context
Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.
@geolens/sdk
source listed< 1.2.3
### Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL (a map, a VRT, a source dataset, an AI request) and failed to re-authorize a **second, caller-influenced dataset** that the request reached through a relationship, layer reference, mosaic source, or request body. This "authorize the URL resource, read a *different* dataset un-re-authorized" pattern let callers read data from datasets they have no access to. The most severe instances require **no authentication at all** (anonymous, network-only). Others require only the **default `editor` role** that any self-service signup / upload user receives. All issues are fixed in **1.2.3**. There is no complete configuration workaround — upgrading is the only full remediation. ### Impact Depending on the endpoint, an attacker can read, for datasets they cannot otherwise access: - the dataset's **vector tile data** (actual feature geometries/attributes), - the dataset's **raster pixels**, - backing-table **rows**, - and **metadata** — table name, column schema, feature count, extent, source URL/filename, contacts, and **sampled row values**. ### Affected versions All versions **pri
geolens-cli
source listed< 1.2.3
### Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL (a map, a VRT, a source dataset, an AI request) and failed to re-authorize a **second, caller-influenced dataset** that the request reached through a relationship, layer reference, mosaic source, or request body. This "authorize the URL resource, read a *different* dataset un-re-authorized" pattern let callers read data from datasets they have no access to. The most severe instances require **no authentication at all** (anonymous, network-only). Others require only the **default `editor` role** that any self-service signup / upload user receives. All issues are fixed in **1.2.3**. There is no complete configuration workaround — upgrading is the only full remediation. ### Impact Depending on the endpoint, an attacker can read, for datasets they cannot otherwise access: - the dataset's **vector tile data** (actual feature geometries/attributes), - the dataset's **raster pixels**, - backing-table **rows**, - and **metadata** — table name, column schema, feature count, extent, source URL/filename, contacts, and **sampled row values**. ### Affected versions All versions **pri
geolens
source listed< 1.2.3
### Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL (a map, a VRT, a source dataset, an AI request) and failed to re-authorize a **second, caller-influenced dataset** that the request reached through a relationship, layer reference, mosaic source, or request body. This "authorize the URL resource, read a *different* dataset un-re-authorized" pattern let callers read data from datasets they have no access to. The most severe instances require **no authentication at all** (anonymous, network-only). Others require only the **default `editor` role** that any self-service signup / upload user receives. All issues are fixed in **1.2.3**. There is no complete configuration workaround — upgrading is the only full remediation. ### Impact Depending on the endpoint, an attacker can read, for datasets they cannot otherwise access: - the dataset's **vector tile data** (actual feature geometries/attributes), - the dataset's **raster pixels**, - backing-table **rows**, - and **metadata** — table name, column schema, feature count, extent, source URL/filename, contacts, and **sampled row values**. ### Affected versions All versions **pri
03 / Response
What to do next
- investigate
Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database
A fixed release is not deployment evidence.
Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.
04 / Limits
What this report cannot establish
- Customer inventory, deployment, reachability and exploitation have not been inspected.
05 / Provenance
Sources you can inspect
Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.
- GHSA-p23g-mvhj-jh3j ↗
GitHub Advisory Database · vendor advisory
Observed . GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.
Public revision history
Only published revisions appear here. Routine fetches do not create a material-change event.
- Revision 1 ·
First indexed by Null; source disclosure date is shown separately.