{"id":"CVE-2026-129467","kind":"vulnerability","aliases":["CVE-2026-129467"],"related":[],"title":"GeoPulse: any logged-in user can read other users' saved locations","description":"GeoPulse 1.5.0 through 2.3.0 contains an insecure direct object reference vulnerability in GET /api/v1/places/geocoding/{id} that allows authenticated users to read other users' private locations. Attackers can enumerate sequential reverse_geocoding_location ids to retrieve other users' custom place names, city, country, coordinates and bounding boxes from their history.","summary":"GeoPulse versions 1.5.0 through 2.3.0 fail to check ownership on the geocoding place endpoint. An authenticated user can enumerate sequential ids to read other users' custom place names, cities, countries, coordinates and bounding boxes.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geopulse","package","self-hosted"],"not_affected_if":["single-user-instance","version-outside-range"],"how_to_check":"- Check the installed GeoPulse version against the range `1.5.0` to `2.3.0`.\n- Look for the route `GET /api/v1/places/geocoding/{id}` in the deployed code.","fix":"- Move to a GeoPulse release newer than `2.3.0`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-11-15T13:16:59+00:00","first_seen_at":"2026-11-15T13:36:04+00:00","triaged_at":"2026-11-15T13:36:24+00:00","updated_at":"2026-11-15T13:36:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-15T13:36:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a GeoPulse release newer than `2.3.0`; the sources do not name the exact fixed version.","reach":"network","title":"GeoPulse: any logged-in user can read other users' saved locations","impact":"medium","summary":"GeoPulse versions 1.5.0 through 2.3.0 fail to check ownership on the geocoding place endpoint. An authenticated user can enumerate sequential ids to read other users' custom place names, cities, countries, coordinates and bounding boxes.","audience":"businesses","category":"package","nicknames":[],"who_cares":["geopulse","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"other users' private location history readable by any account holder","analyst_note":"Confirm the fixed version from the Patch link on github.com and whether 2.3.0 itself is affected.","how_to_check":"- Check the installed GeoPulse version against the range `1.5.0` to `2.3.0`.\n- Look for the route `GET /api/v1/places/geocoding/{id}` in the deployed code.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range","single-user-instance"],"who_is_affected":"Self-hosted or managed GeoPulse deployments running versions 1.5.0 through 2.3.0 where users have accounts on the same instance. An attacker needs a valid login, and the exposure is the geocoding history of every other user on that instance. Single-user installs have little to read across accounts.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4620,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129467':15A,18A '-2026':14A,17A '/api/v1/places/geocoding':71C '1.5.0':26B,59C '2.3.0':28B,61C 'allow':74C 'attack':83C 'authent':39B,75C 'bound':56B,102C 'box':57B,103C 'check':31B 'citi':52B,98C 'contain':62C 'coordin':54B,100C 'countri':53B,99C 'custom':49B,95C 'cve':13A,16A 'direct':65C 'endpoint':37B 'enumer':42B,85C 'fail':29B 'geocod':35B,88C 'geopuls':1A,19B,24B,58C 'get':70C 'histori':106C 'host':23B 'id':44B,72C,90C 'insecur':64C 'locat':12A,82C,89C 'log':4A 'logged-in':3A 'name':51B,97C 'object':66C 'ownership':32B 'packag':20B 'place':36B,50B,96C 'privat':81C 'read':8A,46B,78C 'refer':67C 'retriev':92C 'revers':87C 'save':11A 'self':22B 'self-host':21B 'sequenti':43B,86C 'user':6A,10A,40B,48B,76C,80C,94C 'version':25B 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed GeoPulse deployments running versions 1.5.0 through 2.3.0 where users have accounts on the same instance. An attacker needs a valid login, and the exposure is the geocoding history of every other user on that instance. Single-user installs have little to read across accounts.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["geopulse","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-129467':15A,18A '-2026':14A,17A 'cve':13A,16A 'geopuls':1A 'locat':12A 'log':4A 'logged-in':3A 'read':8A 'save':11A 'user':6A,10A","search_b":"'1.5.0':26B '2.3.0':28B 'authent':39B 'bound':56B 'box':57B 'check':31B 'citi':52B 'coordin':54B 'countri':53B 'custom':49B 'endpoint':37B 'enumer':42B 'fail':29B 'geocod':35B 'geopuls':19B,24B 'host':23B 'id':44B 'name':51B 'ownership':32B 'packag':20B 'place':36B,50B 'read':46B 'self':22B 'self-host':21B 'sequenti':43B 'user':40B,48B 'version':25B","search_c":"'/api/v1/places/geocoding':71C '1.5.0':59C '2.3.0':61C 'allow':74C 'attack':83C 'authent':75C 'bound':102C 'box':103C 'citi':98C 'contain':62C 'coordin':100C 'countri':99C 'custom':95C 'direct':65C 'enumer':85C 'geocod':88C 'geopuls':58C 'get':70C 'histori':106C 'id':72C,90C 'insecur':64C 'locat':82C,89C 'name':97C 'object':66C 'place':96C 'privat':81C 'read':78C 'refer':67C 'retriev':92C 'revers':87C 'sequenti':86C 'user':76C,80C,94C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T13:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129467","severity":null,"published_at":"2026-11-15T13:16:59+00:00","modified_at":"2026-11-15T13:16:59+00:00","first_seen_at":"2026-11-15T13:36:04+00:00","fetched_at":"2026-11-15T13:36:04+00:00","note":null}],"documents":[{"id":163535,"url":"https://github.com/tess1o/geopulse/commit/b994ec588b75357a6da743b0389fcae3c4fa4925","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":163536,"url":"https://www.vulncheck.com/advisories/geopulse-1.5.0-through-2.3.0-idor-via-geocoding-place-details-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}