---
id: "CVE-2026-129467"
page: "https://infrastack.ai/live/CVE-2026-129467"
kind: "vulnerability"
aliases: ["CVE-2026-129467"]
title: "GeoPulse: any logged-in user can read other users' saved locations"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["geopulse", "package", "self-hosted"]
not_affected_if: ["single-user-instance", "version-outside-range"]
published_at: "2026-11-15T13:16:59+00:00"
first_seen_at: "2026-11-15T13:36:04+00:00"
updated_at: "2026-11-15T13:36:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129467", "first_seen_at": "2026-11-15T13:36:04+00:00"}]
exploit_sources: []
---

# GeoPulse: any logged-in user can read other users' saved locations

Link for people: https://infrastack.ai/live/CVE-2026-129467 (this .md is for agents)

GeoPulse versions 1.5.0 through 2.3.0 fail to check ownership on the geocoding place endpoint. An authenticated user can enumerate sequential ids to read other users' custom place names, cities, countries, coordinates and bounding boxes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GeoPulse version against the range `1.5.0` to `2.3.0`.
- Look for the route `GET /api/v1/places/geocoding/{id}` in the deployed code.

## Fix

- Move to a GeoPulse release newer than `2.3.0`; the sources do not name the exact fixed version.

## Timeline

- 2026-11-15T13:36:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129467

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/geopulse-1.5.0-through-2.3.0-idor-via-geocoding-place-details-endpoint
- [fix] Patch: github.com https://github.com/tess1o/geopulse/commit/b994ec588b75357a6da743b0389fcae3c4fa4925

## From the sources

GeoPulse 1.5.0 through 2.3.0 contains an insecure direct object reference vulnerability in GET /api/v1/places/geocoding/{id} that allows authenticated users to read other users' private locations. Attackers can enumerate sequential reverse_geocoding_location ids to retrieve other users' custom place names, city, country, coordinates and bounding boxes from their history.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_