Technical impact
GeoPulse versions 1.5.0 through 2.3.0 contain an insecure direct object reference that allows an authenticated user to request the geocoding place‑details endpoint for any numeric ID. The resulting payload includes the place’s custom name, city, country, coordinates and bounding box, enabling the attacker to reconstruct another user’s private location history. This vulnerability is a classic example of unauthorized disclosure of personal data, which can lead to privacy violations or targeted profiling.
Affected Systems
The affected product is GeoPulse from tess1o. All releases from 1.5.0 up to and including 2.3.0 are vulnerable. Users running any of these versions should verify their installation against the official update logs and consider upgrading to a released version that contains the fix.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity, and while the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation at this time. Exploitation requires the attacker to be authenticated to the service and to guess or enumerate sequential location identifiers. The impact is limited to confidentiality of location data, but the attack can be performed by any legitimate user with brute‑force or enumeration techniques, presenting a non‑negligible risk to affected organizations.
