Is CVE-2026-62945 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62945 being exploited in the wild.

How severe is CVE-2026-62945?

Medium severity, with a CVSS score of 4.3, published 20 August 2026.

Is there a fix for CVE-2026-62945?

A patch was published on 2026-06-27: Fix merged in version 3.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62945 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-62945?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62945: TREK information disclosure via cross-trip file links

CVE-2026-62945 · Severity: medium · CVSS 4.3 · Published 2026-08-20

TREK is a collaborative travel planning application that allows users to organize trips, accommodations, and itineraries together. An authenticated user could exploit improper access controls in the file upload and update features to access and view sensitive reservation information from other private trips they should not have permission to see, disclosing trip names and reservation details across team boundaries.

Quick answers

Is CVE-2026-62945 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62945 being exploited in the wild.
How severe is CVE-2026-62945?: Medium severity, with a CVSS score of 4.3, published 20 August 2026.
Which products and versions are affected?: LikeTrek TREK before 3.1.3.
Is there a fix for CVE-2026-62945?: A patch was published on 2026-06-27: Fix merged in version 3.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62945 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-62945?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass and information disclosure flaw in the file management endpoints. When handling file uploads, updates, or link operations (POST /api/trips/:tripId/files, PUT /api/trips/:tripId/files/:id, POST /api/trips/:tripId/files/:id/link), TREK accepts attacker-controlled reservation_id, place_id, and assignment_id values without validating that these resources belong to the same trip. An authenticated user with file-edit permission can submit foreign object identifiers from other trips. Subsequent read operations through FILE_SELECT or getFileLinks() join the foreign reservation and return its title, leaking the existence and names of private reservations across trip boundaries. This requires authentication and file-edit permission on at least one trip, but allows enumeration of foreign reservation IDs and titles. The fix, released in version 3.1.3, validates all link targets against the trip ID before storage using the findForeignLinkTarget() function.

Affected products

LikeTrek TREK before 3.1.3

Timeline

2026-08-20: disclosed
2026-06-27: patched: Fix merged in version 3.1.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.