CVE-2026-54509
TREK is a collaborative travel planner.
Does this matter?
Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.
Description
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user's journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey's entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.30% probability · 23th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Source
- security-advisories@github.com
References
- https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11
- https://github.com/liketrek/TREK/pull/1185
- https://github.com/liketrek/TREK/releases/tag/v3.1.0
- https://github.com/liketrek/TREK/security/advisories/GHSA-mx6m-qxv8-w624
- https://github.com/liketrek/TREK/security/advisories/GHSA-mx6m-qxv8-w624
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.