What is the CVSS score of CVE-2026-40185?

CVE-2026-40185 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Trek are affected by CVE-2026-40185?

TREK collaborative travel planner versions prior to 2.7.2 contain an authorization bypass affecting trip photo management, allowing authenticated users with low privileges to view and modify photos…. A patch is available.

How to fix or mitigate CVE-2026-40185?

Within 24 hours: Verify current TREK deployment version and confirm if running versions prior to 2.7.2. Within 7 days: Update all TREK instances to version 2.7.2 or later and validate the update in a non-production environment first. Within 30 days: Conduct access logs review for the affected photo management routes to identify any unauthorized access attempts during the vulnerability window, and communicate findings to affected users.

Trek CVE-2026-40185

EUVD-2026-21587 HIGH

Missing Authorization (CWE-862)

2026-04-10 GitHub_M

Authentication Bypass Trek

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 19:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:57 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.7.2

EUVD ID Assigned

Apr 10, 2026 - 20:15 euvd

EUVD-2026-21587

Analysis Generated

Apr 10, 2026 - 20:15 vuln.today

CVE Published

Apr 10, 2026 - 19:40 nvd

HIGH 7.1

DescriptionGitHub Advisory

TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2.

AnalysisAI

Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with low privileges to access and modify trip photos without proper authorization. The missing authorization checks on Immich trip photo management routes enable unauthorized data access (high confidentiality impact) and limited integrity compromise. Exploitation requires authenticated access but no user interaction, exploitable remotely over network with low attack complexity.

Technical ContextAI

CWE-862 missing authorization vulnerability in photo management API endpoints. Application fails to validate user permissions before granting access to trip photo resources within the Immich integration layer. Authenticated users can bypass intended access controls to manipulate photo data belonging to other users' trips. Root cause is absent server-side authorization enforcement on sensitive routes (CPE: cpe:2.3:a:mauriceboe:trek:*:*:*:*:*:*:*:*).

RemediationAI

Vendor-released patch: upgrade immediately to TREK version 2.7.2 or later, which implements proper authorization checks on Immich trip photo management routes. The fix is delivered via commit 16277a3811a00c2983f7486fee83c112986cb179. Organizations unable to upgrade immediately should restrict authenticated user access to TREK instances and audit trip photo access logs for unauthorized activity. Patched release available at https://github.com/mauriceboe/TREK/releases/tag/v2.7.2. Complete security advisory and technical details: https://github.com/mauriceboe/TREK/security/advisories/GHSA-pcr3-6647-jh72. No workaround exists; upgrade is the only complete mitigation.