Read the docs
TI-2026-39355 Aliases CVE-2026-54509

TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)

Priority MEDIUM 62CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user's journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey's entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed TREK (mauriceboe): 3.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mauriceboeTREK3.0.0 to before 3.1.03.1.0Patch availableCNA
  • TREK Vendormauriceboe Affected 3.0.0 to before 3.1.0 Fixed in 3.1.0 Patch available CNA

Remediation

  • Fix · CNA TREK (mauriceboe) Fixed in 3.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54509

References

Other 4

  • TI-2026-53961 TREK: Server-Side Request Forgery via User-Configurable LLM Base URL CVSS 3.1HIGH 8.1
  • TI-2026-53960 TREK: Cross-user note-file deletion (IDOR / Broken Access Control) CVSS 3.1HIGH 7.1
  • TI-2026-53966 Information disclosure in mauriceboe TREK CVSS 3.1MEDIUM 5.3
  • TI-2026-33199 Time-based user enumeration in TREK authentication endpoint CVSS 3.1MEDIUM 5.3
  • TI-2026-39351 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner CVSS 4.0LOW 2.0
  • TI-2026-28999 Missing Authorization on Immich Trip Photo Routes in TREK CVSS 3.1HIGH 7.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences