Read the docs
TI-2026-53966 Aliases CVE-2026-77320

Information disclosure in mauriceboe TREK

Priority MEDIUM 63CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-284.

Summary

TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the map, but the public JSON response still includes the itinerary and place names, coordinates, addresses, descriptions, notes, and prices. Anyone holding the valid share token can therefore read location and route information that the owner explicitly chose not to share, although the random token remains required and the flaw does not permit modification. This issue is fixed in version 3.3.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Fix Fixed TREK (mauriceboe): 3.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mauriceboeTREKbefore 3.3.03.3.0Patch availableCNA
  • TREK Vendormauriceboe Affected before 3.3.0 Fixed in 3.3.0 Patch available CNA

Remediation

  • Fix · CNA TREK (mauriceboe) Fixed in 3.3.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77320

References

Other 4

  • TI-2026-53961 TREK: Server-Side Request Forgery via User-Configurable LLM Base URL CVSS 3.1HIGH 8.1
  • TI-2026-53960 TREK: Cross-user note-file deletion (IDOR / Broken Access Control) CVSS 3.1HIGH 7.1
  • TI-2026-33199 Time-based user enumeration in TREK authentication endpoint CVSS 3.1MEDIUM 5.3
  • TI-2026-39355 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak) CVSS 3.1MEDIUM 6.5
  • TI-2026-39351 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner CVSS 4.0LOW 2.0
  • TI-2026-28999 Missing Authorization on Immich Trip Photo Routes in TREK CVSS 3.1HIGH 7.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences