Executive brief
TREK is a collaborative travel planning application that allows users to share journey details with others via tokens. A vulnerability in versions 3.0.0 to 3.1.0 allows any authenticated user to obtain unauthorized access to other users' journeys by enumerating journey IDs and retrieving their share tokens, exposing sensitive trip data including locations, photos, and personal notes without the journey owner's consent.
Technical details
The GET /api/journeys/:id/share-link endpoint in server/src/routes/journey.ts fails to validate that the authenticated requester owns or has permission to access the targeted journey before returning its share token. An attacker can enumerate sequential journey IDs and request share links for any journey; the endpoint returns a valid share token without authorization checks. The token can then be used with the unauthenticated GET /api/public/journey/:token endpoint to retrieve journey entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This is an insecure direct object reference (IDOR) vulnerability requiring only network access and valid authentication. The vulnerability was fixed in version 3.1.0 by adding proper authorization checks.
Affected products
- TREK TREK 3.0.0 to 3.0.x
Timeline
- 2026-08-20: disclosed: CVE-2026-54509 published on NVD
- 2026-06-16: patched: Fix released in version 3.1.0