CVE-2026-129467 · Package
NO FIX YET · SEE WHAT TO DO
GeoPulse versions 1.5.0 through 2.3.0 fail to check ownership on the geocoding place endpoint. An authenticated user can enumerate sequential ids to read other users' custom place names, cities, countries, coordinates and bounding boxes.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted or managed GeoPulse deployments running versions 1.5.0 through 2.3.0 where users have accounts on the same instance. An attacker needs a valid login, and the exposure is the geocoding history of every other user on that instance. Single-user installs have little to read across accounts.
Not affected if single-user-instance, version-outside-range
Who cares geopulse, self-hosted
1.5.0 to 2.3.0.GET /api/v1/places/geocoding/{id} in the deployed code.2.3.0; the sources do not name the exact fixed version.GeoPulse 1.5.0 through 2.3.0 contains an insecure direct object reference vulnerability in GET /api/v1/places/geocoding/{id} that allows authenticated users to read other users' private locations. Attackers can enumerate sequential reverse_geocoding_location ids to retrieve other users' custom place names, city, country, coordinates and bounding boxes from their history.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.