CVE-2026-40185

| EUVD-2026-21587 HIGH
2026-04-10 GitHub_M
7.1
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

3
Analysis Generated
Apr 10, 2026 - 20:15 vuln.today
EUVD ID Assigned
Apr 10, 2026 - 20:15 euvd
EUVD-2026-21587
CVE Published
Apr 10, 2026 - 19:40 nvd
HIGH 7.1

Tags

Authentication Bypass Trek

Description

TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2.

Analysis

Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with low privileges to access and modify trip photos without proper authorization. The missing authorization checks on Immich trip photo management routes enable unauthorized data access (high confidentiality impact) and limited integrity compromise. …

Sign in for full analysis, threat intelligence, and remediation guidance.

Remediation

Within 24 hours: Identify all TREK deployments and confirm installed versions against version 2.7.2 requirement. Within 7 days: Implement network-level access controls to restrict Immich trip photo management API routes to designated administrators or implement role-based access restrictions at the application gateway level; document all compensating controls deployed. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +36
POC: 0

Share

CVE-2026-40185 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy