GeoLens, a self-hosted geospatial data catalog, has multiple authorization vulnerabilities in versions before 1.2.3. The flaws involve insufficient re-authorization checks when accessing related datasets through various endpoints such as map layers, VRT sources, externalId lookups, and request bodies. This allows anonymous users to retrieve private dataset metadata and sampled data by exploiting public map references and dataset relationship APIs. Authenticated users with editor privileges can mosaic private rasters from other users without visibility enforcement. The vulnerabilities expose a wide range of sensitive data including vector geometries, raster pixels, table rows, schemas, feature counts, extents, source URLs, filenames, contacts, and sampled values. The issue is resolved in GeoLens version 1.2.3.

Unauthorized actors, including anonymous users, can access sensitive private geospatial data and metadata that should be restricted. This includes vector and raster data, database schemas, and contact information. The exposure can lead to data leakage of confidential or restricted datasets. The vulnerability does not impact data integrity or availability but results in a high confidentiality impact.

Upgrade GeoLens to version 1.2.3 or later, where these authorization issues are fixed. No other mitigations are indicated or required as the vendor has provided an official fix.