TREK, a collaborative travel planning platform, has a flaw where the get_trip_summary endpoint performs no check for the required trips:read OAuth scope. As a result, any OAuth token granted with an unrelated capability, such as weather:read, can retrieve sensitive trip information. The endpoint returns core trip metadata, member email addresses, itinerary days, and accommodation details for all trips that the token’s user can access. This bypass of the delegated scope limits undermines the consented least‑privilege boundary and exposes private and third‑party contact information without authorization.

The vulnerability affects the TREK application produced by mauriceboe. Versions prior to 3.3.0 are impacted; version 3.3.0 and later contain the fix.

The CVSS score of 4.3 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs an OAuth token granted to a legitimate client, even if the token has no trips:read scope. Because the token’s user is still the same, the attacker can read all trip data belonging to that user, compromising confidentiality of personal and contact information. Cross‑user authorization remains intact, but the scope bypass erodes the expected least‑privilege model.