CVE-2026-77320
mediumTREK is a collaborative travel planner.
TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the map, but the public JSON response still includes the itinerary and place names, coordinates, addresses, descriptions, notes, and prices. Anyone holding the valid share token can therefore read location and route information that the owner explicitly chose not to share, although the random token remains required and the flaw does not permit modification. This issue is fixed in version 3.3.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2 security-advisories@github.com
- https://github.com/liketrek/TREK/pull/1520 security-advisories@github.com
- https://github.com/liketrek/TREK/releases/tag/v3.3.0 security-advisories@github.com
- https://github.com/liketrek/TREK/security/advisories/GHSA-9hc8-p7gm-p7mx security-advisories@github.com
- https://github.com/liketrek/TREK/security/advisories/GHSA-9hc8-p7gm-p7mx 134c704f-9b21-4f2e-91b3-4a467353bcc0