GHSA-P77J-G7H5-R2VW: Tier-0 Security Hardening in GeoLens
Vulnerability ID: GHSA-P77J-G7H5-R2VW
CVSS Score: 8.8
Published: 2026-08-19
GeoLens before version 1.2.4 contains multiple critical-tier security vulnerabilities including improper authorization in metadata access, tile cache scope leakage, dataset title enumeration, weak default credentials, and denial of service via STAC POST search.
TL;DR
Multiple vulnerabilities in GeoLens allow unauthorized metadata and map tile disclosure, unauthenticated Denial of Service, and administrative takeover via weak default credentials.
Technical Details
- CWE ID: CWE-285
- Attack Vector: Network
- CVSS v3.1 Score: 8.8
- EPSS Score: 0.001
- Impact: Data Disclosure / System Compromise
- Exploit Status: none
- CISA KEV Status: Not Listed
Affected Systems
- GeoLens Catalog System
- GeoLens Installer Tool
- GeoLens STAC API Module
Mitigation Strategies
- Upgrading GeoLens to version 1.2.4 or higher
- Configuring reverse proxies to bypass cache for non-public coordinate requests
- Applying web application firewall (WAF) size limits on STAC search POST endpoints
Remediation Steps:
- Verify environment variables and check out tag v1.2.4
- Run the automated installer script
./scripts/install.shto update backend files and apply database migrations - Rotate default database and administrator passwords in the
.envconfiguration file - Restart Nginx and restart backend application containers to reload the updated security configuration
References
- https://github.com/geolens-io/geolens
- https://github.com/geolens-io/geolens/security/advisories/GHSA-p77j-g7h5-r2vw
- https://github.com/geolens-io/geolens/pull/243
- https://github.com/geolens-io/geolens/releases/tag/v1.2.4
- https://github.com/advisories/GHSA-P77J-G7H5-R2VW
- https://github.com/advisories/GHSA-p23g-mvhj-jh3j
Read the full report for GHSA-P77J-G7H5-R2VW on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)