TREK, a collaborative travel planning application, exposed uploaded photographs to any user before version 2.7.2. The application failed to enforce authentication when serving these files, permitting an attacker to retrieve any photo that had been previously uploaded. This flaw results in a confidentiality breach, allowing adversaries to view or steal private media without permission. The weakness aligns with CWE-306, which involves missing or ineffective authentication controls.

The affected product is TREK by Mauriceboe. Versions released prior to 2.7.2 are vulnerable. Users running any build before the patch have cells of plain access to uploaded media.

The CVSS score of 3.7 indicates low severity from a technical perspective. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The likely attack vector is remote and unauthenticated: a malicious actor can perform a simple HTTP request to the photo URL and obtain the content. Because the flaw removes authentication entirely, the risk to confidentiality is high for any user contributing photos to the platform, while the overall likelihood of large‑scale impact is limited by the low CVSS rating.