The TREK collaborative travel planner contained an insecure DELETE endpoint that allowed an authenticated user to delete note‑file attachments belonging to any trip they could identify, regardless of ownership. The endpoint authenticated the user only against the tripId supplied in the URL but then resolved the file solely by noteId and fileId, ignoring the trip context. As a result, an attacker with edit rights to any trip could submit identifiers that belong to another user’s trip and permanently remove that user’s attachment. This flaw is classified under IDOR and Broken Access Control (CWE-639 and CWE-862).

The vulnerability affects all deployments of TREK prior to version 3.3.0, including the open‑source edition provided by mauriceboe. Any user who can edit a trip possesses the ability to delete arbitrary note‑file attachments from other trips when the system is running a vulnerable version.

The CVSS score of 7.1 indicates a moderately high risk. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, so the overall exploitation probability is uncertain. The attack requires an authenticated user with edit permissions; once this condition is met, the mis‑authorization allows direct deletion of any note‑file attachment, potentially leading to data loss, user frustration, or denial of service for affected trips. The fix is available in TREK 3.3.0, which removes the insecure delete logic.