Description
Multiple GeoLens read/link endpoints authorized only the resource named in the request URL (a map, a VRT, a source dataset, an AI request) and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or request body.
Recommendation
Update the @geolens/sdk package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.2.3
- Patched version(s): 1.2.3
References
Could your website be exposed too?
SmartScanner can check your website for GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and r and gives you actionable findings to investigate.
Start a free scanRelated Issues
- OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data ex - CVE-2026-30956
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/vue - CVE-2026-42349
- StudioCMS has Authorization Bypass Through User-Controlled Key - CVE-2026-24134
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/shared - CVE-2026-42349
You might also like:
See something that needs correcting? Let us knowUpdated August 18, 2026