GHSA-p77j-g7h5-r2vw: GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

August 19, 2026

GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain data and metadata for datasets they are not authorized to access.

References

github.com/advisories/GHSA-p23g-mvhj-jh3j
github.com/advisories/GHSA-p77j-g7h5-r2vw
github.com/geolens-io/geolens/pull/243
github.com/geolens-io/geolens/releases/tag/v1.2.4
github.com/geolens-io/geolens/security/advisories/GHSA-p77j-g7h5-r2vw

Code Behaviors & Features

Detect and mitigate GHSA-p77j-g7h5-r2vw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →