CVE-2026-77321 Details
Description
TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. A token granted only an unrelated capability, such as weather:read, can receive trip metadata, member email addresses from server/src/services/tripService.ts, itinerary days, and accommodations for every trip accessible to the token's user. Cross-user trip authorization remains enforced, but the missing scope check defeats the consented least-privilege boundary and exposes trip content and third-party contact information to an MCP client that was not authorized to read it. This issue is fixed in version 3.3.0.
A vulnerability exists in TREK's Model Context Protocol (MCP) API, specifically in the 'get_trip_summary' tool, prior to version 3.3.0. This tool is registered for scoped OAuth MCP tokens without proper scope validation, allowing any valid token to access sensitive trip data. A token granted only an unrelated capability, such as 'weather:read', can retrieve core trip summary data, including member email addresses, itinerary details, and accommodations for every trip accessible to the token's user. While cross-user trip authorization is enforced, the lack of proper scope checks undermines the intended least-privilege model, exposing trip content and personal contact information to unauthorized MCP clients.
Users should update to TREK version 3.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2 | [email protected] | Source CodeVendor |
| https://github.com/liketrek/TREK/pull/1520 | [email protected] | Issue TrackingVendor |
| https://github.com/liketrek/TREK/releases/tag/v3.3.0 | [email protected] | Release NotesVendor |
| https://github.com/liketrek/TREK/security/advisories/GHSA-qvw8-w937-vcmq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TREK | <= 3.2.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |