Executive brief
TREK is a collaborative travel planning application that allows users to organize trips, accommodations, and itineraries together. An authenticated user could exploit improper access controls in the file upload and update features to access and view sensitive reservation information from other private trips they should not have permission to see, disclosing trip names and reservation details across team boundaries.
Technical details
The vulnerability is an authorization bypass and information disclosure flaw in the file management endpoints. When handling file uploads, updates, or link operations (POST /api/trips/:tripId/files, PUT /api/trips/:tripId/files/:id, POST /api/trips/:tripId/files/:id/link), TREK accepts attacker-controlled reservation_id, place_id, and assignment_id values without validating that these resources belong to the same trip. An authenticated user with file-edit permission can submit foreign object identifiers from other trips. Subsequent read operations through FILE_SELECT or getFileLinks() join the foreign reservation and return its title, leaking the existence and names of private reservations across trip boundaries. This requires authentication and file-edit permission on at least one trip, but allows enumeration of foreign reservation IDs and titles. The fix, released in version 3.1.3, validates all link targets against the trip ID before storage using the findForeignLinkTarget() function.
Affected products
- LikeTrek TREK before 3.1.3
Timeline
- 2026-08-20: disclosed
- 2026-06-27: patched: Fix merged in version 3.1.3