Is CVE-2026-78887 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78887 being exploited in the wild.

How severe is CVE-2026-78887?

Low severity, with a CVSS score of 3.7, published 25 August 2026.

Is there a fix for CVE-2026-78887?

A patch was published on 2026-06-16: Version 3.1.0 released with security fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78887 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-78887?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78887: liketrek TREK incorrect authorization in Journey photo proxy

CVE-2026-78887 · Severity: low · CVSS 3.7 · Published 2026-08-25

TREK is a travel planning and expense-tracking application. A vulnerability in the photo-sharing feature allows an attacker with any valid journey share link to access private photos from the account holder's photo storage service (Immich or Synology), including images never shared in the journey. This represents a privacy breach exposing sensitive personal photos without authorization.

Quick answers

Is CVE-2026-78887 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78887 being exploited in the wild.
How severe is CVE-2026-78887?: Low severity, with a CVSS score of 3.7, published 25 August 2026.
Which products and versions are affected?: liketrek TREK up to 3.0.22.
Is there a fix for CVE-2026-78887?: A patch was published on 2026-06-16: Version 3.1.0 released with security fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78887 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-78887?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Incorrect Authorization (CWE-863) / Insecure Direct Object Reference (IDOR) in the validateShareTokenForAsset function within the Journey Photo Proxy component. When a user requests a photo asset via the public endpoint GET /api/public/journey/:token/photo/:provider/:assetId/:ownerId/:kind, the function has a permissive fallback that returns the journey owner's credentials instead of null when the requested assetId is not part of the shared journey. An attacker with any valid journey share token can exploit this to stream arbitrary assets from the owner's connected photo backend (Immich or Synology) using the owner's stored credentials. Attack complexity is high due to the need to guess 128-bit UUIDs, but UUIDs obtained via other channels simplify exploitation. The fix in version 3.1.0 changes the fallback to return null (deny) when assets are not part of the shared journey, matching the secure validateShareTokenForPhoto behavior. No user interaction is required; exploitation requires only network access and possession of a valid journey share token.

Affected products

liketrek TREK up to 3.0.22

Timeline

2026-06: disclosed: Reported via coordinated private disclosure by ByteJMP
2026-06-16: patched: Version 3.1.0 released with security fix
2026-08-25: advisory: CVE-2026-78887 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.