SEC-A Cross-Station Authorization Flaw: Fix for Anonymous Access to Private Vector Tiles

Vulnerability Key Information Summary Vulnerability Overview Vulnerability ID: SEC-A (Phase 1038/SEC-A, Anonymous Access, HIGH Severity) Vulnerability Description: Cross-station authorization flaw located in anonymous map read endpoints. and are authorized to access metadata of private datasets (table_name, column_info, feature_count, extent, sample_values) but are unauthorized to access the actual vector tiles of those datasets. Reachability: Since is bound to anonymous users and accepts signed URLs without a user context, anonymous callers can read the actual vector tiles of private datasets. Reachability Supplement: verifies only for the caller (admin/owner). When adding layers to a public map, if not validated, anonymous users can attach their private datasets to public maps (existing / RBAC filtering happens to exclude this state's reachability). Impact Scope Affected Endpoints: , Affected Data: Vector tiles of private datasets Affected Users: Anonymous callers (no user context) Remediation Fix Commit: Fix Details: - In , the 's and filter the attached layer rows, discarding layers that are not visible to the caller via (admin/owner retain their own, anonymous users see only ). - The two GET handlers filter the layer set after acquiring the map access check and before constructing the response. - discards excluded layers and includes the dataset source and in the signed URL for changes. - The re-export endpoint pins the map service to and adds to changes. - Follows the codebase's existing design ( , , RBAC) rather than blocking writes—because public maps may still contain non-public layers, which are now hidden from unauthorized readers. Discarded Approach The original plan included an optional defense-in-depth check to reject adding non-public datasets to public maps. This test status shows (constructs an exposure state to public datasets via RBAC filtering) and aligns with the codebase's philosophy. Pinning the map service to in the read path is the authoritative fix for SEC-A. Testing Test File: Test Cases: - REG-1: (omits private dataset layers, no metadata/sample_values leak) - REG-2: (omits private dataset sources + replaceable signed URLs) - REG-3 (Control): Public dataset layers remain visible—the guard does not over-filter - REG-4: override still shows own private layers—the guard maintains read path access Verification Results: REG-1 and REG-2 failed before the fix and passed after. is green (150), plus / / / (57)—no regressions. Only authorization logic changed, no schema changes. Related Fixes (Same Batch)

Goal Reached Thanks to every supporter — we hit 100%!

SEC-A Cross-Station Authorization Flaw: Fix for Anonymous Access to Private Vector Tiles

More from this source