The flaw resides in the TREK travel‑planning server where a GET request to /api/shared/:token returns full itinerary details even when the trip owner has disabled the "share_map" permission. The client dashboard hides the map, but the raw JSON payload still includes day schedules, place names, coordinates, addresses, descriptions, notes, and prices. Because the share token itself is required and randomly generated, any user who possesses it can read the hidden location and route data that the owner explicitly chose not to share. This constitutes a server‑side authorization bypass leading to accidental disclosure of protected trip information.

The vulnerability affects deployments of MAURICEBOE™ TREK version 3.2.x and earlier. Any installation that has not upgraded to v3.3.0 or newer is vulnerable. No patched version before 3.3.0 contains a fix for this issue.

The CVSS score of 5.3 indicates medium severity. No EPSS score is provided, so the exploitation probability cannot be quantified. The flaw is listed as not in the CISA KEV catalog. The attack requires possession of a valid share token and the ability to issue a simple HTTP GET request to the shared endpoint, making it a remote, low‑barrier information‑disclosure vulnerability.