Search
Find a vulnerability
Search criteria
14 vulnerabilities by mauriceboe
CVE-2026-62945 (GCVE-0-2026-62945)
Vulnerability from nvd – Published: 2026-08-20 21:51 – Updated: 2026-08-21 15:42
VLAI
EPSS
VEX
Title
TREK: Cross-trip reservation title disclosure via file links
Summary
TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Subsequent reads through FILE_SELECT or getFileLinks() join the foreign reservation and return reservation_title, disclosing reservation existence and titles across private trip boundaries. This issue is fixed in version 3.1.3.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 15:41 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/liketrek/TREK/security/advisor… | x_refsource_CONFIRM |
| https://github.com/liketrek/TREK/pull/1324 | x_refsource_MISC |
| https://github.com/liketrek/TREK/commit/03cdb4d27… | x_refsource_MISC |
| https://github.com/liketrek/TREK/releases/tag/v3.1.3 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
< 3.1.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62945",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T15:41:53.264990Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T15:42:07.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file\u0027s trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Subsequent reads through FILE_SELECT or getFileLinks() join the foreign reservation and return reservation_title, disclosing reservation existence and titles across private trip boundaries. This issue is fixed in version 3.1.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:51:19.844Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/liketrek/TREK/security/advisories/GHSA-r4cp-666p-8f69",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-r4cp-666p-8f69"
},
{
"name": "https://github.com/liketrek/TREK/pull/1324",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/pull/1324"
},
{
"name": "https://github.com/liketrek/TREK/commit/03cdb4d27689922460ba87085d04b426d4d40d26",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/commit/03cdb4d27689922460ba87085d04b426d4d40d26"
},
{
"name": "https://github.com/liketrek/TREK/releases/tag/v3.1.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.3"
}
],
"source": {
"advisory": "GHSA-r4cp-666p-8f69",
"discovery": "UNKNOWN"
},
"title": "TREK: Cross-trip reservation title disclosure via file links"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62945",
"datePublished": "2026-08-20T21:51:19.844Z",
"dateReserved": "2026-07-14T22:32:17.731Z",
"dateUpdated": "2026-08-21T15:42:07.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54509 (GCVE-0-2026-54509)
Vulnerability from nvd – Published: 2026-08-20 21:49 – Updated: 2026-08-21 14:57
VLAI
EPSS
VEX
Title
TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)
Summary
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user's journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey's entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 14:57 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/liketrek/TREK/security/advisor… | x_refsource_CONFIRM |
| https://github.com/liketrek/TREK/pull/1185 | x_refsource_MISC |
| https://github.com/liketrek/TREK/commit/ad893eb1c… | x_refsource_MISC |
| https://github.com/liketrek/TREK/releases/tag/v3.1.0 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
>= 3.0.0, < 3.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54509",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T14:57:35.764393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T14:57:42.795Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-mx6m-qxv8-w624"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user\u0027s journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey\u0027s entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:49:49.877Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/liketrek/TREK/security/advisories/GHSA-mx6m-qxv8-w624",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-mx6m-qxv8-w624"
},
{
"name": "https://github.com/liketrek/TREK/pull/1185",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/pull/1185"
},
{
"name": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11"
},
{
"name": "https://github.com/liketrek/TREK/releases/tag/v3.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0"
}
],
"source": {
"advisory": "GHSA-mx6m-qxv8-w624",
"discovery": "UNKNOWN"
},
"title": "TREK IDOR: any authenticated user can read another user\u0027s journey share token (full journey leak)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54509",
"datePublished": "2026-08-20T21:49:49.877Z",
"dateReserved": "2026-06-15T18:01:15.513Z",
"dateUpdated": "2026-08-21T14:57:42.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54508 (GCVE-0-2026-54508)
Vulnerability from nvd – Published: 2026-08-20 21:46 – Updated: 2026-08-21 21:45
VLAI
EPSS
VEX
Title
TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution
Summary
TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNaverList() in server/src/services/placeService.ts and resolveGoogleMapsUrl() in server/src/services/mapsService.ts. The affected sinks call checkSsrf() from server/src/utils/ssrfGuard.ts and then use fetch() with redirect: 'follow' instead of the DNS-pinned safeFetch() path, so a public attacker-controlled URL can redirect the server to loopback, RFC 1918, or cloud metadata addresses without revalidation. An authenticated trip member can reach the list-import routes, and any authenticated user can reach /api/maps/resolve-url, allowing blind GET requests to internal services without response-body reflection. This issue is fixed in version 3.1.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 20:58 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/liketrek/TREK/security/advisor… | x_refsource_CONFIRM |
| https://github.com/liketrek/TREK/pull/1185 | x_refsource_MISC |
| https://github.com/liketrek/TREK/commit/ad893eb1c… | x_refsource_MISC |
| https://github.com/liketrek/TREK/releases/tag/v3.1.0 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
< 3.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54508",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T20:58:30.346217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:45:07.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNaverList() in server/src/services/placeService.ts and resolveGoogleMapsUrl() in server/src/services/mapsService.ts. The affected sinks call checkSsrf() from server/src/utils/ssrfGuard.ts and then use fetch() with redirect: \u0027follow\u0027 instead of the DNS-pinned safeFetch() path, so a public attacker-controlled URL can redirect the server to loopback, RFC 1918, or cloud metadata addresses without revalidation. An authenticated trip member can reach the list-import routes, and any authenticated user can reach /api/maps/resolve-url, allowing blind GET requests to internal services without response-body reflection. This issue is fixed in version 3.1.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:46:51.288Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/liketrek/TREK/security/advisories/GHSA-f5vh-p2h5-x735",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-f5vh-p2h5-x735"
},
{
"name": "https://github.com/liketrek/TREK/pull/1185",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/pull/1185"
},
{
"name": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11"
},
{
"name": "https://github.com/liketrek/TREK/releases/tag/v3.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0"
}
],
"source": {
"advisory": "GHSA-f5vh-p2h5-x735",
"discovery": "UNKNOWN"
},
"title": "TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54508",
"datePublished": "2026-08-20T21:46:51.288Z",
"dateReserved": "2026-06-15T18:01:15.512Z",
"dateUpdated": "2026-08-21T21:45:07.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54505 (GCVE-0-2026-54505)
Vulnerability from nvd – Published: 2026-08-20 21:44 – Updated: 2026-08-25 15:30
VLAI
EPSS
VEX
Title
TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner
Summary
TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 15:30 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/liketrek/TREK/security/advisor… | x_refsource_CONFIRM |
| https://github.com/liketrek/TREK/pull/1185 | x_refsource_MISC |
| https://github.com/liketrek/TREK/commit/ad893eb1c… | x_refsource_MISC |
| https://github.com/liketrek/TREK/releases/tag/v3.1.0 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
< 3.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54505",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T15:30:10.707921Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:30:48.581Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator\u0027s session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:44:50.337Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9"
},
{
"name": "https://github.com/liketrek/TREK/pull/1185",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/pull/1185"
},
{
"name": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11"
},
{
"name": "https://github.com/liketrek/TREK/releases/tag/v3.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0"
}
],
"source": {
"advisory": "GHSA-g8rf-gqrw-4qf9",
"discovery": "UNKNOWN"
},
"title": "TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54505",
"datePublished": "2026-08-20T21:44:50.337Z",
"dateReserved": "2026-06-15T18:01:15.512Z",
"dateUpdated": "2026-08-25T15:30:48.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45410 (GCVE-0-2026-45410)
Vulnerability from nvd – Published: 2026-05-28 21:23 – Updated: 2026-05-29 14:46
VLAI
EPSS
VEX
Title
Time-based user enumeration in TREK authentication endpoint
Summary
TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before returning a 401 Unauthorized, adding ~370 ms of latency. When the email did not exist, the backend returned immediately (~10 ms). This ~14× timing difference could be detected without any difference in HTTP status codes or response bodies. This vulnerability is fixed in 3.0.18.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-29 14:46 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/mauriceboe/TREK/security/advis… | x_refsource_CONFIRM |
| https://gist.github.com/jubnl/c2402adf85d946c1730… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
< 3.0.18
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45410",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-29T14:46:27.011976Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-29T14:46:58.159Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-3552-3c98-x79r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.18"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before returning a 401 Unauthorized, adding ~370 ms of latency. When the email did not exist, the backend returned immediately (~10 ms). This ~14\u00d7 timing difference could be detected without any difference in HTTP status codes or response bodies. This vulnerability is fixed in 3.0.18."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "CWE-203: Observable Discrepancy",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208: Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T21:23:01.431Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-3552-3c98-x79r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-3552-3c98-x79r"
},
{
"name": "https://gist.github.com/jubnl/c2402adf85d946c1730867aeecc794de",
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/jubnl/c2402adf85d946c1730867aeecc794de"
}
],
"source": {
"advisory": "GHSA-3552-3c98-x79r",
"discovery": "UNKNOWN"
},
"title": "Time-based user enumeration in TREK authentication endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45410",
"datePublished": "2026-05-28T21:23:01.431Z",
"dateReserved": "2026-05-12T01:48:40.452Z",
"dateUpdated": "2026-05-29T14:46:58.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40185 (GCVE-0-2026-40185)
Vulnerability from nvd – Published: 2026-04-10 19:40 – Updated: 2026-04-15 15:09
VLAI
EPSS
VEX
Title
Missing Authorization on Immich Trip Photo Routes in TREK
Summary
TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 15:08 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/mauriceboe/TREK/security/advis… | x_refsource_CONFIRM |
| https://github.com/mauriceboe/TREK/commit/16277a3… | x_refsource_MISC |
| https://github.com/mauriceboe/TREK/releases/tag/v2.7.2 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
< 2.7.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40185",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T15:08:28.395142Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T15:09:36.514Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003c 2.7.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T19:40:16.382Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-pcr3-6647-jh72",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-pcr3-6647-jh72"
},
{
"name": "https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179"
},
{
"name": "https://github.com/mauriceboe/TREK/releases/tag/v2.7.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mauriceboe/TREK/releases/tag/v2.7.2"
}
],
"source": {
"advisory": "GHSA-pcr3-6647-jh72",
"discovery": "UNKNOWN"
},
"title": "Missing Authorization on Immich Trip Photo Routes in TREK"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-40185",
"datePublished": "2026-04-10T19:40:16.382Z",
"dateReserved": "2026-04-09T20:59:17.619Z",
"dateUpdated": "2026-04-15T15:09:36.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40184 (GCVE-0-2026-40184)
Vulnerability from nvd – Published: 2026-04-10 19:39 – Updated: 2026-04-13 16:12
VLAI
EPSS
VEX
Title
Unauthenticated Access to Uploaded Files in TREK
Summary
TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-13 16:12 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/mauriceboe/TREK/security/advis… | x_refsource_CONFIRM |
| https://github.com/mauriceboe/TREK/commit/16277a3… | x_refsource_MISC |
| https://github.com/mauriceboe/TREK/releases/tag/v2.7.2 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
< 2.7.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40184",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-13T16:12:41.757685Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T16:12:51.487Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003c 2.7.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T19:39:32.442Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-wxx3-84fc-mrx2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-wxx3-84fc-mrx2"
},
{
"name": "https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179"
},
{
"name": "https://github.com/mauriceboe/TREK/releases/tag/v2.7.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mauriceboe/TREK/releases/tag/v2.7.2"
}
],
"source": {
"advisory": "GHSA-wxx3-84fc-mrx2",
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Access to Uploaded Files in TREK"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-40184",
"datePublished": "2026-04-10T19:39:32.442Z",
"dateReserved": "2026-04-09T20:59:17.619Z",
"dateUpdated": "2026-04-13T16:12:51.487Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62945 (GCVE-0-2026-62945)
Vulnerability from cvelistv5 – Published: 2026-08-20 21:51 – Updated: 2026-08-21 15:42
VLAI
EPSS
VEX
Title
TREK: Cross-trip reservation title disclosure via file links
Summary
TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Subsequent reads through FILE_SELECT or getFileLinks() join the foreign reservation and return reservation_title, disclosing reservation existence and titles across private trip boundaries. This issue is fixed in version 3.1.3.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 15:41 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/liketrek/TREK/security/advisor… | x_refsource_CONFIRM |
| https://github.com/liketrek/TREK/pull/1324 | x_refsource_MISC |
| https://github.com/liketrek/TREK/commit/03cdb4d27… | x_refsource_MISC |
| https://github.com/liketrek/TREK/releases/tag/v3.1.3 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
< 3.1.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62945",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T15:41:53.264990Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T15:42:07.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file\u0027s trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Subsequent reads through FILE_SELECT or getFileLinks() join the foreign reservation and return reservation_title, disclosing reservation existence and titles across private trip boundaries. This issue is fixed in version 3.1.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:51:19.844Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/liketrek/TREK/security/advisories/GHSA-r4cp-666p-8f69",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-r4cp-666p-8f69"
},
{
"name": "https://github.com/liketrek/TREK/pull/1324",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/pull/1324"
},
{
"name": "https://github.com/liketrek/TREK/commit/03cdb4d27689922460ba87085d04b426d4d40d26",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/commit/03cdb4d27689922460ba87085d04b426d4d40d26"
},
{
"name": "https://github.com/liketrek/TREK/releases/tag/v3.1.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.3"
}
],
"source": {
"advisory": "GHSA-r4cp-666p-8f69",
"discovery": "UNKNOWN"
},
"title": "TREK: Cross-trip reservation title disclosure via file links"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62945",
"datePublished": "2026-08-20T21:51:19.844Z",
"dateReserved": "2026-07-14T22:32:17.731Z",
"dateUpdated": "2026-08-21T15:42:07.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54509 (GCVE-0-2026-54509)
Vulnerability from cvelistv5 – Published: 2026-08-20 21:49 – Updated: 2026-08-21 14:57
VLAI
EPSS
VEX
Title
TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)
Summary
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user's journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey's entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 14:57 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/liketrek/TREK/security/advisor… | x_refsource_CONFIRM |
| https://github.com/liketrek/TREK/pull/1185 | x_refsource_MISC |
| https://github.com/liketrek/TREK/commit/ad893eb1c… | x_refsource_MISC |
| https://github.com/liketrek/TREK/releases/tag/v3.1.0 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
>= 3.0.0, < 3.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54509",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T14:57:35.764393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T14:57:42.795Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-mx6m-qxv8-w624"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user\u0027s journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey\u0027s entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:49:49.877Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/liketrek/TREK/security/advisories/GHSA-mx6m-qxv8-w624",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-mx6m-qxv8-w624"
},
{
"name": "https://github.com/liketrek/TREK/pull/1185",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/pull/1185"
},
{
"name": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11"
},
{
"name": "https://github.com/liketrek/TREK/releases/tag/v3.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0"
}
],
"source": {
"advisory": "GHSA-mx6m-qxv8-w624",
"discovery": "UNKNOWN"
},
"title": "TREK IDOR: any authenticated user can read another user\u0027s journey share token (full journey leak)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54509",
"datePublished": "2026-08-20T21:49:49.877Z",
"dateReserved": "2026-06-15T18:01:15.513Z",
"dateUpdated": "2026-08-21T14:57:42.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54508 (GCVE-0-2026-54508)
Vulnerability from cvelistv5 – Published: 2026-08-20 21:46 – Updated: 2026-08-21 21:45
VLAI
EPSS
VEX
Title
TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution
Summary
TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNaverList() in server/src/services/placeService.ts and resolveGoogleMapsUrl() in server/src/services/mapsService.ts. The affected sinks call checkSsrf() from server/src/utils/ssrfGuard.ts and then use fetch() with redirect: 'follow' instead of the DNS-pinned safeFetch() path, so a public attacker-controlled URL can redirect the server to loopback, RFC 1918, or cloud metadata addresses without revalidation. An authenticated trip member can reach the list-import routes, and any authenticated user can reach /api/maps/resolve-url, allowing blind GET requests to internal services without response-body reflection. This issue is fixed in version 3.1.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 20:58 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/liketrek/TREK/security/advisor… | x_refsource_CONFIRM |
| https://github.com/liketrek/TREK/pull/1185 | x_refsource_MISC |
| https://github.com/liketrek/TREK/commit/ad893eb1c… | x_refsource_MISC |
| https://github.com/liketrek/TREK/releases/tag/v3.1.0 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
< 3.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54508",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T20:58:30.346217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:45:07.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNaverList() in server/src/services/placeService.ts and resolveGoogleMapsUrl() in server/src/services/mapsService.ts. The affected sinks call checkSsrf() from server/src/utils/ssrfGuard.ts and then use fetch() with redirect: \u0027follow\u0027 instead of the DNS-pinned safeFetch() path, so a public attacker-controlled URL can redirect the server to loopback, RFC 1918, or cloud metadata addresses without revalidation. An authenticated trip member can reach the list-import routes, and any authenticated user can reach /api/maps/resolve-url, allowing blind GET requests to internal services without response-body reflection. This issue is fixed in version 3.1.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:46:51.288Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/liketrek/TREK/security/advisories/GHSA-f5vh-p2h5-x735",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-f5vh-p2h5-x735"
},
{
"name": "https://github.com/liketrek/TREK/pull/1185",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/pull/1185"
},
{
"name": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11"
},
{
"name": "https://github.com/liketrek/TREK/releases/tag/v3.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0"
}
],
"source": {
"advisory": "GHSA-f5vh-p2h5-x735",
"discovery": "UNKNOWN"
},
"title": "TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54508",
"datePublished": "2026-08-20T21:46:51.288Z",
"dateReserved": "2026-06-15T18:01:15.512Z",
"dateUpdated": "2026-08-21T21:45:07.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54505 (GCVE-0-2026-54505)
Vulnerability from cvelistv5 – Published: 2026-08-20 21:44 – Updated: 2026-08-25 15:30
VLAI
EPSS
VEX
Title
TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner
Summary
TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 15:30 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/liketrek/TREK/security/advisor… | x_refsource_CONFIRM |
| https://github.com/liketrek/TREK/pull/1185 | x_refsource_MISC |
| https://github.com/liketrek/TREK/commit/ad893eb1c… | x_refsource_MISC |
| https://github.com/liketrek/TREK/releases/tag/v3.1.0 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
< 3.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54505",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T15:30:10.707921Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:30:48.581Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator\u0027s session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:44:50.337Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9"
},
{
"name": "https://github.com/liketrek/TREK/pull/1185",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/pull/1185"
},
{
"name": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11"
},
{
"name": "https://github.com/liketrek/TREK/releases/tag/v3.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0"
}
],
"source": {
"advisory": "GHSA-g8rf-gqrw-4qf9",
"discovery": "UNKNOWN"
},
"title": "TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54505",
"datePublished": "2026-08-20T21:44:50.337Z",
"dateReserved": "2026-06-15T18:01:15.512Z",
"dateUpdated": "2026-08-25T15:30:48.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45410 (GCVE-0-2026-45410)
Vulnerability from cvelistv5 – Published: 2026-05-28 21:23 – Updated: 2026-05-29 14:46
VLAI
EPSS
VEX
Title
Time-based user enumeration in TREK authentication endpoint
Summary
TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before returning a 401 Unauthorized, adding ~370 ms of latency. When the email did not exist, the backend returned immediately (~10 ms). This ~14× timing difference could be detected without any difference in HTTP status codes or response bodies. This vulnerability is fixed in 3.0.18.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-29 14:46 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/mauriceboe/TREK/security/advis… | x_refsource_CONFIRM |
| https://gist.github.com/jubnl/c2402adf85d946c1730… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
< 3.0.18
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45410",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-29T14:46:27.011976Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-29T14:46:58.159Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-3552-3c98-x79r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.18"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before returning a 401 Unauthorized, adding ~370 ms of latency. When the email did not exist, the backend returned immediately (~10 ms). This ~14\u00d7 timing difference could be detected without any difference in HTTP status codes or response bodies. This vulnerability is fixed in 3.0.18."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "CWE-203: Observable Discrepancy",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208: Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T21:23:01.431Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-3552-3c98-x79r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-3552-3c98-x79r"
},
{
"name": "https://gist.github.com/jubnl/c2402adf85d946c1730867aeecc794de",
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/jubnl/c2402adf85d946c1730867aeecc794de"
}
],
"source": {
"advisory": "GHSA-3552-3c98-x79r",
"discovery": "UNKNOWN"
},
"title": "Time-based user enumeration in TREK authentication endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45410",
"datePublished": "2026-05-28T21:23:01.431Z",
"dateReserved": "2026-05-12T01:48:40.452Z",
"dateUpdated": "2026-05-29T14:46:58.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40185 (GCVE-0-2026-40185)
Vulnerability from cvelistv5 – Published: 2026-04-10 19:40 – Updated: 2026-04-15 15:09
VLAI
EPSS
VEX
Title
Missing Authorization on Immich Trip Photo Routes in TREK
Summary
TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 15:08 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/mauriceboe/TREK/security/advis… | x_refsource_CONFIRM |
| https://github.com/mauriceboe/TREK/commit/16277a3… | x_refsource_MISC |
| https://github.com/mauriceboe/TREK/releases/tag/v2.7.2 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
< 2.7.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40185",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T15:08:28.395142Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T15:09:36.514Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003c 2.7.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T19:40:16.382Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-pcr3-6647-jh72",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-pcr3-6647-jh72"
},
{
"name": "https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179"
},
{
"name": "https://github.com/mauriceboe/TREK/releases/tag/v2.7.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mauriceboe/TREK/releases/tag/v2.7.2"
}
],
"source": {
"advisory": "GHSA-pcr3-6647-jh72",
"discovery": "UNKNOWN"
},
"title": "Missing Authorization on Immich Trip Photo Routes in TREK"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-40185",
"datePublished": "2026-04-10T19:40:16.382Z",
"dateReserved": "2026-04-09T20:59:17.619Z",
"dateUpdated": "2026-04-15T15:09:36.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40184 (GCVE-0-2026-40184)
Vulnerability from cvelistv5 – Published: 2026-04-10 19:39 – Updated: 2026-04-13 16:12
VLAI
EPSS
VEX
Title
Unauthenticated Access to Uploaded Files in TREK
Summary
TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-13 16:12 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/mauriceboe/TREK/security/advis… | x_refsource_CONFIRM |
| https://github.com/mauriceboe/TREK/commit/16277a3… | x_refsource_MISC |
| https://github.com/mauriceboe/TREK/releases/tag/v2.7.2 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mauriceboe | TREK |
Affected:
< 2.7.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40184",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-13T16:12:41.757685Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T16:12:51.487Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TREK",
"vendor": "mauriceboe",
"versions": [
{
"status": "affected",
"version": "\u003c 2.7.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T19:39:32.442Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-wxx3-84fc-mrx2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-wxx3-84fc-mrx2"
},
{
"name": "https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179"
},
{
"name": "https://github.com/mauriceboe/TREK/releases/tag/v2.7.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mauriceboe/TREK/releases/tag/v2.7.2"
}
],
"source": {
"advisory": "GHSA-wxx3-84fc-mrx2",
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Access to Uploaded Files in TREK"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-40184",
"datePublished": "2026-04-10T19:39:32.442Z",
"dateReserved": "2026-04-09T20:59:17.619Z",
"dateUpdated": "2026-04-13T16:12:51.487Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}