Threats tagged 'ghsa-6hh5-5g4m-3g64'

GeoPulse versions 1.5.0 through 2.3.0 have an insecure direct object reference vulnerability in the GET /api/v1/places/geocoding/{id} endpoint. Authenticated users can exploit this flaw to access private location data of other users by enumerating sequential location IDs. The exposed information includes custom place names, city, country, coordinates, and bounding boxes from users' location history.