GHSA-p23g-mvhj-jh3j: GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

GeoLens had multiple authorization bypass vulnerabilities where the system only checked permission for the resource named in the URL but failed to re-check permission for a second dataset accessed through relationships or references, allowing attackers to read private dataset metadata, table rows, vector tiles (map feature data), and raster pixels (image pixel values). Some vulnerabilities required no login at all, while others only needed a default user account. All issues are fixed in version 1.2.3.