Executive brief
TREK is a travel planning and expense-tracking application. A vulnerability in the photo-sharing feature allows an attacker with any valid journey share link to access private photos from the account holder's photo storage service (Immich or Synology), including images never shared in the journey. This represents a privacy breach exposing sensitive personal photos without authorization.
Technical details
The vulnerability is an Incorrect Authorization (CWE-863) / Insecure Direct Object Reference (IDOR) in the validateShareTokenForAsset function within the Journey Photo Proxy component. When a user requests a photo asset via the public endpoint GET /api/public/journey/:token/photo/:provider/:assetId/:ownerId/:kind, the function has a permissive fallback that returns the journey owner's credentials instead of null when the requested assetId is not part of the shared journey. An attacker with any valid journey share token can exploit this to stream arbitrary assets from the owner's connected photo backend (Immich or Synology) using the owner's stored credentials. Attack complexity is high due to the need to guess 128-bit UUIDs, but UUIDs obtained via other channels simplify exploitation. The fix in version 3.1.0 changes the fallback to return null (deny) when assets are not part of the shared journey, matching the secure validateShareTokenForPhoto behavior. No user interaction is required; exploitation requires only network access and possession of a valid journey share token.
Affected products
- liketrek TREK up to 3.0.22
Timeline
- 2026-06: disclosed: Reported via coordinated private disclosure by ByteJMP
- 2026-06-16: patched: Version 3.1.0 released with security fix
- 2026-08-25: advisory: CVE-2026-78887 published