CVE-2026-77320 Details
Description
TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the map, but the public JSON response still includes the itinerary and place names, coordinates, addresses, descriptions, notes, and prices. Anyone holding the valid share token can therefore read location and route information that the owner explicitly chose not to share, although the random token remains required and the flaw does not permit modification. This issue is fixed in version 3.3.0.
A vulnerability exists in TREK, a collaborative travel planning application, in versions prior to 3.3.0. The issue arises in the shareService, where the 'getSharedTripData' function fails to respect the 'share_map' permission. This function unconditionally returns itinerary and location data through the 'GET /api/shared/:token' endpoint, even when the trip owner has disabled map sharing. As a result, anyone with a valid share token can access detailed itinerary information and location coordinates that the owner intended to keep private.
The vulnerability has been fixed in TREK version 3.3.0, which enforces the 'share_map' permission server-side, ensuring that itinerary and location data is withheld when the owner chooses not to share it.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2 | [email protected] | Source CodeVendor |
| https://github.com/liketrek/TREK/pull/1520 | [email protected] | Issue TrackingVendor |
| https://github.com/liketrek/TREK/releases/tag/v3.3.0 | [email protected] | Release NotesVendor |
| https://github.com/liketrek/TREK/security/advisories/GHSA-9hc8-p7gm-p7mx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
| CWE-602 | Client-Side Enforcement of Server-Side Security | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TREK | <= 3.2.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |