In TREK versions prior to 2.7.2, the routes that manage Immich trip photos lack proper authorization checks. This allows any user—whether authenticated or not—to call those endpoints and retrieve or manipulate photos associated with any trip. As a result, confidential travel imagery could be exposed and integrity of photo management could be compromised. The weakness corresponds to unauthorized access (CWE-862).

The affected product is TREK, a collaborative travel planner. All releases before version 2.7.2 are vulnerable; the issue is fixed in the 2.7.2 release. Users running earlier builds should treat these versions as exposed.

The CVSS score of 7.1 indicates a high severity risk, with the main concern being confidentiality due to potential unrestricted photo access. The EPSS score is not available, but the lack of a KEV listing suggests no publicly known exploits yet. The vulnerability can be exploited by sending standard HTTP requests to the protected endpoints; no special conditions beyond basic network access are required.