Is CVE-2026-77321 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77321 being exploited in the wild.

How severe is CVE-2026-77321?

Medium severity, with a CVSS score of 4.3, published 24 September 2026.

Is there a fix for CVE-2026-77321?

A patch was published on 2026-07-11: Fixed in version 3.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77321 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-77321?

Check whether you run Liketrek TREK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77321: TREK get_trip_summary missing scope validation

CVE-2026-77321 · Severity: medium · CVSS 4.3 · Published 2026-09-24

TREK is a collaborative travel planner. Before version 3.3.0, the trip summary tool fails to check whether a user has permission to read trips, allowing MCP clients with unrelated permissions (like weather:read) to access trip metadata, member email addresses, itineraries, and accommodations. This bypasses the principle of least privilege and exposes private trip content and third-party contact information to unauthorized applications.

Technologies: Liketrek TREK. Vendors: Liketrek.

Quick answers

Is CVE-2026-77321 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77321 being exploited in the wild.
How severe is CVE-2026-77321?: Medium severity, with a CVSS score of 4.3, published 24 September 2026.
Which products and versions are affected?: Liketrek TREK before 3.3.0.
Is there a fix for CVE-2026-77321?: A patch was published on 2026-07-11: Fixed in version 3.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77321 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-77321?: Check whether you run Liketrek TREK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The get_trip_summary tool in server/src/mcp/tools/trips.ts does not validate the trips:read scope before returning trip data, allowing any OAuth MCP token with access to the user's account to retrieve sensitive trip information. The vulnerability affects the OAuth scoping mechanism and requires an attacker to hold a valid MCP token (with different scopes) for a user account. Cross-user authorization checks remain in place, limiting exposure to trips accessible to the token holder's own user account.

Affected products

liketrek TREK before 3.3.0

Timeline

2026-09-24: disclosed: CVE-2026-77321 published
2026-07-11: patched: Fixed in version 3.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.