# GHSA-p77j-g7h5-r2vw: GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain data and metadata f > GeoLens allows unauthorized users to access private dataset metadata and tiles due to missing authorization checks and cache misconfigurations. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 19 Aug 2026 ## What is GHSA-p77j-g7h5-r2vw? GHSA-p77j-g7h5-r2vw is a missing authorization vulnerability in geolens, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim. ### Official description GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain data and metadata for datasets they are not authorized to access. ### Impact - **Private record metadata disclosure.** Record contact, keyword, and distribution sub-resource endpoints did not re-authorize the backing dataset, so any authenticated user could read a private record's contact details (PII), keywords, and distributions. (Runtime-proven.) - **Private tile data via shared caches.** Private raster and vector tiles were served with shared-cache (`Cache-Control: public`) headers, so a shared cache (a CDN or the bundled reverse proxy) could retain private tile bytes and replay them to later unauthenticated requests, including unpublished public-dataset previews. - **Private dataset title enumeration.** The map visibility-check endpoint did not authorize read access to the map, allowing any editor to enumerate the titles of non-public datasets in any map by ID — including private maps owned by other users. - **SSRF via DNS rebinding.** URL validation for user-supplied service URLs (probes, STAC/OGC API sources, manifest downloads) resolved DNS once and then let the HTTP client re-resolve at connect time, allowing a low-TTL domain to pass validation as a public address and connect to an internal/metadata address. - **Token leak + header injection in service preview.** The remote-service preview path passed the authorization token to GDAL via the process environment without sanitization, leaking it through `/proc//environ` and allowing CRLF header injection. - **Unauthenticated STAC search DoS.** `POST /search` did not cap the size of GeoJSON `intersects` geometries (the `GET` sibling did). - **API key written to access logs.** The bundled reverse proxy logged the `api_key` query-string credential in cleartext. - **Security posture coupled to a logging flag.** API documentation exposure and the Secure flag on the OAuth session cookie were keyed off the `LOG_JSON` logging flag rather than an explicit environment setting, so a production deployment at the default could expose `/docs` and emit a non-Secure session cookie. - **Missing Content-Security-Policy (defense-in-depth).** The web application shipped no `script-src`/`default-src` CSP, leaving no containment for token exfiltration if an XSS issue were introduced. - **Weak default install credentials.** The installer kept the published default database password and could silently retain the default admin password on a headless install. ### Patches Upgrade to **GeoLens 1.2.4**. No configuration changes are required for the authorization and cache fixes. Operators on a public, TLS-terminated deployment should additionally set `ENVIRONMENT=production` to make the production security posture explicit; deployments that do not set it retain their prior behavior. ### Workarounds None for the authorization/cache disclosure flaws — upgrading is required. The SSRF and STAC-DoS surfaces can be partially mitigated at the network/proxy layer (egress filtering to block link-local metadata addresses; a request-size limit on `POST /search`), but the code fix is the durable remedy. ### References - Release: https://github.com/geolens-io/geolens/releases/tag/v1.2.4 - Pull request: https://github.com/geolens-io/geolens/pull/243 - Prior related advisory: GHSA-p23g-mvhj-jh3j ## Which versions are affected by GHSA-p77j-g7h5-r2vw? 2 open source packages ship an affected version, including geolens. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `geolens` | PyPI | All versions | 1.2.4 | | `geolens` | PyPI | All versions | 1.2.4 | ## How do I fix GHSA-p77j-g7h5-r2vw? Upgrade geolens to 1.2.4 or later. ## Is GHSA-p77j-g7h5-r2vw being exploited? There is no known exploitation of GHSA-p77j-g7h5-r2vw in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-p77j-g7h5-r2vw and fix it if it is affected. What it is: GHSA-p77j-g7h5-r2vw is a missing authorization vulnerability in geolens, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim. Exploitation: There is no known exploitation of GHSA-p77j-g7h5-r2vw in the wild and no public exploit code. Affected packages and fixed versions: - geolens (PyPI): affected all versions; fixed in 1.2.4 - geolens (PyPI): affected all versions; fixed in 1.2.4 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-p77j-g7h5-r2vw/ (Markdown: https://insights.sbomify.com/GHSA-p77j-g7h5-r2vw/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-p77j-g7h5-r2vw --- From sbomify Insights: https://insights.sbomify.com/GHSA-p77j-g7h5-r2vw/ Summaries are generated and may contain mistakes; the official description above is the record.