{"answers":{"affected":"8 open source packages ship an affected version, including geolens, geolens-cli and @geolens/sdk.","exploited":"There is no known exploitation of CVE-2026-55178 in the wild and no public exploit code.","fix":"Upgrade geolens to 1.2.3 or later.","what":"CVE-2026-55178 is a high-severity missing authorization vulnerability in geolens-io geolens, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-55178 and fix it if it is affected.\n\nWhat it is: CVE-2026-55178 is a high-severity missing authorization vulnerability in geolens-io geolens, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-55178 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- geolens (PyPI): affected all versions; fixed in 1.2.3\n- geolens (PyPI): affected all versions; fixed in 1.2.3\n- geolens (PyPI): affected all versions; fixed in 1.2.3\n- geolens-cli (PyPI): affected all versions; fixed in 1.2.3\n- geolens-cli (PyPI): affected all versions; fixed in 1.2.3\n- geolens-cli (PyPI): affected all versions; fixed in 1.2.3\n- @geolens/sdk (npm): affected all versions; fixed in 1.2.3\n- @geolens/sdk (npm): affected all versions; fixed in 1.2.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-55178/ (Markdown: https://insights.sbomify.com/CVE-2026-55178/index.md)","id":"CVE-2026-55178","markdown":"https://insights.sbomify.com/CVE-2026-55178/index.md","name":"CVE-2026-55178","record":{"aliases":["GHSA-p23g-mvhj-jh3j","PYSEC-2026-3662","PYSEC-2026-3663"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Geospatial data catalog","requires_auth":"none","summary":"Attackers can bypass authorization checks to read private dataset metadata, schemas, and tile data in GeoLens.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"},{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a relationship, map layer, VRT source, externalId lookup, or request body. When a public map references a private dataset, anonymous callers can use GET /maps/{id} and GET /maps/{id}/style.json to obtain the private layer's metadata, sampled values, or vector tiles. The style response can expose a replayable HMAC tile URL that is bound to neither a user nor a map. When a public source dataset has a relationship to a private target dataset, anonymous callers can use the dataset relationship APIs to enumerate the relationship and read rows from the private target's backing table. Anonymous callers can also use GET /collections/datasets/items with an externalId dataset UUID to obtain metadata for any private, restricted, or unpublished dataset because that lookup performs no visibility check. Authenticated users with the default editor role can mosaic another user's private raster into an owned VRT and read its pixels, and POST /ai/metadata/{summary,keywords,lineage,quality-statement} accepts a body-controlled dataset_id without a visibility check and returns private metadata and sample values. Pre-existing vrt_source_links also expose unauthorized member metadata and health unless each member is filtered at read time. These paths can disclose vector geometries and attributes, raster pixels, table rows, table names, column schemas, feature counts, extents, source URLs and filenames, contacts, and sampled row values. This issue is fixed in version 1.2.3.","ecosystems":["PyPI","npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data","id":"CVE-2026-55178","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":8,"n_references":12,"next":{"headline":"Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID","id":"CVE-2026-55179"},"packages":[{"ecosystem":"PyPI","fixed":["1.2.3"],"introduced":["0"],"last_affected":[],"package":"geolens","purl":null,"source":"GHSA-p23g-mvhj-jh3j"},{"ecosystem":"PyPI","fixed":["1.2.3"],"introduced":["0"],"last_affected":[],"package":"geolens","purl":"pkg:pypi/geolens","source":"GHSA-p23g-mvhj-jh3j"},{"ecosystem":"PyPI","fixed":["1.2.3"],"introduced":["0"],"last_affected":[],"package":"geolens","purl":"pkg:pypi/geolens","source":"PYSEC-2026-3662"},{"ecosystem":"PyPI","fixed":["1.2.3"],"introduced":["0"],"last_affected":[],"package":"geolens-cli","purl":null,"source":"GHSA-p23g-mvhj-jh3j"},{"ecosystem":"PyPI","fixed":["1.2.3"],"introduced":["0"],"last_affected":[],"package":"geolens-cli","purl":"pkg:pypi/geolens-cli","source":"GHSA-p23g-mvhj-jh3j"},{"ecosystem":"PyPI","fixed":["1.2.3"],"introduced":["0"],"last_affected":[],"package":"geolens-cli","purl":"pkg:pypi/geolens-cli","source":"PYSEC-2026-3663"},{"ecosystem":"npm","fixed":["1.2.3"],"introduced":["0"],"last_affected":[],"package":"@geolens/sdk","purl":null,"source":"GHSA-p23g-mvhj-jh3j"},{"ecosystem":"npm","fixed":["1.2.3"],"introduced":["0"],"last_affected":[],"package":"@geolens/sdk","purl":"pkg:npm/%40geolens/sdk","source":"GHSA-p23g-mvhj-jh3j"}],"prev":{"headline":"CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard","id":"CVE-2026-55177"},"products":["geolens"],"published":"2026-09-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-17","vendors":["geolens-io"]},"summary":"Attackers can bypass authorization checks to read private dataset metadata, schemas, and tile data in GeoLens.","url":"https://insights.sbomify.com/CVE-2026-55178/"}