The vulnerability resides in an authenticated endpoint that returns a share link for a journey without verifying the requester's authorization to access that journey.An attacker who is logged in can simply enumerate sequential journey identifiers, retrieve the associated share token, and then use an unauthenticated public endpoint to view all data tied to that journey, including entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This flaw is a classic missing authorization (CWE‑862) that results in sensitive data exposure.

The affected product is TREK, a collaborative travel planner, published under the vendor mauriceboe. The flaw exists in versions from 3.0.0 up through, but not including, 3.1.0. Version 3.1.0 and later contain the fix.

With a CVSS score of 6.5 the vulnerability is moderate in severity. No EPSS score is provided, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to be authenticated to the application, after which they can brute‑force or systematically request journey IDs, obtain the share token, and then access full journey data via a public API. Given the lack of immediate exploitation scores, the risk remains present until the authorized check is restored or the software is updated.