Executive brief
TREK is a collaborative travel planning application. A security flaw in versions prior to 2.7.2 allowed any logged-in user to view or modify photos and album links belonging to other users' private trips. This could lead to the unauthorized exposure of personal travel photos and the modification of trip data.
Technical details
A missing authorization vulnerability (CWE-862) exists in TREK's Immich integration routes. Specifically, the application failed to perform 'canAccessTrip' checks on endpoints including GET/POST/DELETE /trips/:tripId/photos and related album-link routes. An authenticated attacker could exploit this by supplying a trip ID belonging to another user, allowing them to view, add, or delete photos and manage sharing links. The vulnerability is resolved in version 2.7.2 by enforcing proper membership validation for all trip-related photo management requests.
Affected products
- mauriceboe TREK < 2.7.2
Timeline
- 2026-04-01: patched: Fix released in version 2.7.2
- 2026-04-10: disclosed: Initial CVE publication
- 2026-04-21: advisory: NVD analysis updated