→

CVE-2026-55178: GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

Summary

Multiple GeoLens read/link endpoints authorized only the resource named in the request URL (a map, a VRT, a source dataset, an AI request) and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or request body. This "authorize the URL resource, read a different dataset un-re-authorized" pattern let callers read data from datasets they have no access to.

The most severe instances require no authentication at all (anonymous, network-only). Others require only the default editor role that any self-service signup / upload user receives.

All issues are fixed in 1.2.3. There is no complete configuration workaround — upgrading is the only full remediation.

Impact

Depending on the endpoint, an attacker can read, for datasets they cannot otherwise access:

the dataset's vector tile data (actual feature geometries/attributes),
the dataset's raster pixels,
backing-table rows,
and metadata — table name, column schema, feature count, extent, source URL/filename, contacts, and sampled row values.

Affected versions

All versions prior to 1.2.3 (includes the published 1.0.0, 1.2.0, and 1.2.2 releases and their PyPI/npm/GHCR artifacts). Fixed in 1.2.3.

Findings

1. Anonymous metadata + private vector-tile disclosure via public maps (PR #235) GET /maps/{id} and GET /maps/{id}/style.json authorized the map but not each layer's backing dataset. A public map that references a private dataset leaked that dataset's table name, column schema, feature count, extent, and sampled values to anonymous callers. style.json additionally returned a vector-tile URL carrying an HMAC signature bound to , which the tile endpoint accepts for non-public datasets with no user check — so the signature is to read the private dataset's actual vector tiles.

Miggo Vulnerability Database

→

CVE-2026-55178

CVE-2026-55178:

7.5

CVSS Score

3.1

-

CVSS Score

-

Basic Information

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@geolens/sdk	npm	< 1.2.3	1.2.3
geolens-cli	pip	< 1.2.3	1.2.3
geolens	pip	< 1.2.3	1.2.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the vulnerability is a systemic failure to re-authorize secondary datasets that are accessed via a primary, authorized resource. Multiple endpoints across the GeoLens API (for dataset relationships, maps, OGC search, VRT mosaics, and AI metadata) would authorize the resource named in the URL but then proceed to access, process, or link a second dataset influenced by the caller without verifying the caller's permissions for that second dataset. This allowed attackers, ranging from anonymous users to authenticated editors, to bypass access controls and read sensitive information from private datasets, including metadata, table rows, and raw raster/vector data. The patches consistently fix this by adding explicit authorization checks (using check_dataset_access or check_dataset_access_or_anonymous) for these secondary datasets at the point of access, either at read time or link/write time, ensuring a fail-closed security posture.

Vulnerable functions

app.modules.catalog.datasets.api.router_metadata.list_dataset_relationships

backend/app/modules/catalog/datasets/api/router_metadata.py

The original function did not check for authorization on the target dataset of a relationship. The patch adds `user` and `user_roles` to the `list_relationships` call, which then filters out relationships pointing to datasets the user cannot access. This prevents leaking the existence and metadata of private datasets through public ones.

app.modules.catalog.datasets.api.router_metadata.get_feature_related_records

backend/app/modules/catalog/datasets/api/router_metadata.py

The function failed to authorize the target dataset before returning related records. An attacker could exploit a public dataset's relationship to a private one to read rows from the private dataset's backing table. The patch adds an explicit authorization check on the `target_dataset`.

app.modules.catalog.maps.router.get_map_endpoint

backend/app/modules/catalog/maps/router.py

This endpoint only authorized access to the map object, not the datasets backing each of its layers. This allowed an anonymous user to view a public map and leak metadata (and tile data via the style endpoint) from any private datasets used as layers. The patch adds a filtering step to remove layers backed by datasets the user cannot access.

app.modules.catalog.maps.router.export_map_style_endpoint

backend/app/modules/catalog/maps/router.py

Similar to `get_map_endpoint`, this function for exporting a map's style only authorized the map itself. This allowed anonymous users to get a replayable, signed URL for vector tiles of private datasets included as layers in a public map. The patch adds the same visibility filter to prevent this.

app.modules.catalog.search.router.collection_items

backend/app/modules/catalog/search/router.py

When looking up a dataset by `externalId`, the function did not perform any visibility check. The `user` identity was not passed down to the lookup function. This allowed an anonymous attacker to retrieve the full metadata of any private, restricted, or unpublished dataset by its UUID. The patch threads the `user` object into the lookup to enable authorization.

app.processing.ingest.service.create_vrt_job

backend/app/processing/ingest/service.py

The function allowed users with 'upload' permission to create a Virtual Raster Tile (VRT) without authorizing access to the source datasets. An attacker could mosaic another user's private raster into a VRT they own and then read the victim's pixel data. The patch adds a loop to authorize each source dataset.

app.processing.ingest.router.add_vrt_source

backend/app/processing/ingest/router.py

Similar to VRT creation, adding a source to an existing VRT did not authorize the source dataset. This allowed an attacker to link a victim's private raster to their own VRT, enabling pixel data theft. The patch adds the necessary `check_dataset_access` call.

app.processing.ai.router.generate_metadata_summary

backend/app/processing/ai/router.py

This endpoint, along with other AI metadata endpoints, was only gated by a general AI usage permission. It failed to authorize the specific `dataset_id` provided in the request body. This allowed an editor to extract sensitive metadata and sample data from any private dataset by passing its UUID. The patch adds a call to a new authorization helper function.

app.processing.ai.router.generate_metadata_keywords

backend/app/processing/ai/router.py

This endpoint, along with other AI metadata endpoints, was only gated by a general AI usage permission. It failed to authorize the specific `dataset_id` provided in the request body. This allowed an editor to extract sensitive metadata and sample data from any private dataset by passing its UUID. The patch adds a call to a new authorization helper function.

app.processing.ai.router.generate_metadata_lineage

backend/app/processing/ai/router.py

This endpoint, along with other AI metadata endpoints, was only gated by a general AI usage permission. It failed to authorize the specific `dataset_id` provided in the request body. This allowed an editor to extract sensitive metadata and sample data from any private dataset by passing its UUID. The patch adds a call to a new authorization helper function.

app.processing.ai.router.generate_metadata_quality_statement

backend/app/processing/ai/router.py

This endpoint, along with other AI metadata endpoints, was only gated by a general AI usage permission. It failed to authorize the specific `dataset_id` provided in the request body. This allowed an editor to extract sensitive metadata and sample data from any private dataset by passing its UUID. The patch adds a call to a new authorization helper function.