# CVE-2026-77320: TREK collaborative travel planner information disclosure in shared trip API

Source: https://junglewise.ai/threats/cve-2026-77320-trek-is-a-collaborative-travel-planner-prior-to-3-3-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-77320 · Severity: medium · CVSS 5.3 · Published 2026-09-24

TREK is a collaborative travel planning application that allows users to share trips with others via a token-based link. A flaw in versions prior to 3.3.0 causes the API to leak sensitive location data, itineraries, coordinates, and notes even when the trip owner has disabled map sharing. Although the share token is required to access the data and no modification is possible, anyone with the token can retrieve detailed travel routing and pricing information the owner intended to keep private.

Technologies: [Liketrek TREK](https://junglewise.ai/threats/technologies/liketrek-trek). Vendors: [Liketrek](https://junglewise.ai/threats/vendors/liketrek).

## Quick answers

**Is CVE-2026-77320 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77320 being exploited in the wild.

**How severe is CVE-2026-77320?** Medium severity, with a CVSS score of 5.3, published 24 September 2026.

**Which products and versions are affected?** Liketrek TREK before 3.3.0.

**Is there a fix for CVE-2026-77320?** A patch was published on 2026-07-11: version 3.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77320 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-77320?** Check whether you run Liketrek TREK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The getSharedTripData function in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token regardless of the share_map setting. The client-side UI correctly hides the map when share_map is disabled, but the underlying JSON response still includes all location and itinerary details. The vulnerability requires a valid share token (a form of access control) and permits only read-only access, but represents a logic flaw where server-side access controls do not match the owner's sharing preferences.

## Affected products

- liketrek TREK before 3.3.0

## Timeline

- 2026-09-24: disclosed
- 2026-07-11: patched: version 3.3.0 released

## References

- [https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2](https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2)
- [https://github.com/liketrek/TREK/pull/1520](https://github.com/liketrek/TREK/pull/1520)

## Related threats

- [TREK SSRF bypass via IPv6 transition addresses](https://junglewise.ai/threats/cve-2026-85738-trek-is-a-collaborative-travel-planner-prior-to-3-4-0-the)
- [TREK get_trip_summary missing scope validation](https://junglewise.ai/threats/cve-2026-77321-trek-is-a-collaborative-travel-planner-prior-to-3-3-0-the-get)
- [TREK server-side request forgery in LLM settings](https://junglewise.ai/threats/cve-2026-77294-trek-is-a-collaborative-travel-planner-prior-to-3-3-0-trek-allows)