CVE-2026-77293 Details
Description
TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and file identifiers without requiring the file to belong to that trip. A user with edit access to any trip can submit identifiers belonging to another user's trip and permanently delete that note-file attachment. Sequential identifiers make broad targeting practical, while attachment read operations remain trip-scoped and are not affected. This issue is fixed in version 3.3.0.
A cross-user note-file deletion vulnerability has been identified in TREK, a collaborative travel planner, in versions prior to 3.3.0. This vulnerability allows an authenticated user with low privileges to permanently delete note-file attachments belonging to other users. The issue arises in the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint, which incorrectly authorizes deletion requests based on the trip ID provided by the attacker, without verifying that the note and file belong to that trip. As a result, a user with edit access to any trip can delete attachments from other users' trips, leading to unauthorized data loss.
Users are advised to update to TREK version 3.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/liketrek/TREK/security/advisories/GHSA-cjc5-722j-vvmf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2 | [email protected] | Source CodeVendor |
| https://github.com/liketrek/TREK/pull/1520 | [email protected] | Issue TrackingVendor |
| https://github.com/liketrek/TREK/releases/tag/v3.3.0 | [email protected] | Release NotesVendor |
| https://github.com/liketrek/TREK/security/advisories/GHSA-cjc5-722j-vvmf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TREK | <= 3.1.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |
| Sep 24, 2026 | CVE Modified | CISA-ADP |