Description
TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Subsequent reads through FILE_SELECT or getFileLinks() join the foreign reservation and return reservation_title, disclosing reservation existence and titles across private trip boundaries. This issue is fixed in version 3.1.3.
Published: 2026-08-20
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

TREK is a collaborative travel planner in which authenticated users with file‑editing rights on any trip can submit arbitrary reservation identifiers via API endpoints such as POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Because the system does not verify that the referenced reservation belongs to the file's trip, a join occurs that returns reservation_title. This allows a user to learn about reservations that belong to another private trip, effectively disclosing reservation titles across trip boundaries. The vulnerability is an authorization bypass (CWE‑639) that leads to a confidentiality breach.

Affected Systems

mauriceboe TREK versions earlier than 3.1.3 are affected. The flaw was resolved in release v3.1.3.

Risk and Exploitability

With a CVSS score of 4.3, the vulnerability is considered moderate. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, indicating it is not actively exploited at the time of assessment. The attack requires an authenticated user with permission to edit file objects in any trip; therefore, the risk is limited to users with such access, but any such user can exfiltrate reservation information from other trips.

Generated by OpenCVE AI on August 21, 2026 at 00:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade TREK to version 3.1.3 or later.
  • Audit and restrict file‑edit permissions so that only trusted users can modify trip files.
  • Validate reservation identifiers against the owning trip before linking, ensuring findForeignLinkTarget() logic is applied or rejection of foreign IDs.

Generated by OpenCVE AI on August 21, 2026 at 00:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Mauriceboe
Mauriceboe trek
Vendors & Products Mauriceboe
Mauriceboe trek

Thu, 20 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Subsequent reads through FILE_SELECT or getFileLinks() join the foreign reservation and return reservation_title, disclosing reservation existence and titles across private trip boundaries. This issue is fixed in version 3.1.3.
Title TREK: Cross-trip reservation title disclosure via file links
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Mauriceboe Trek
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-21T15:42:07.158Z

Reserved: 2026-07-14T22:32:17.731Z

Link: CVE-2026-62945

cve-icon Vulnrichment

Updated: 2026-08-21T15:42:01.037Z

cve-icon NVD

Status : Received

Published: 2026-08-20T22:17:46.740

Modified: 2026-08-21T16:17:52.947

Link: CVE-2026-62945

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T00:30:07Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key