TREK CVE-2026-54509

Exploitation requires a valid authenticated TREK user account on the target instance - any ordinary registered user qualifies, as no elevated role or admin privilege is needed (CVSS PR:L). The attack relies on journey IDs being enumerable; the description implies sequential integer IDs, which makes enumeration straightforward with no rate-limit or lockout bypass required. The second phase of the attack - accessing stolen tokens via the public endpoint - requires no authentication at all, meaning tokens can be distributed to unauthenticated third parties after retrieval. Limiting factors: the attacker must have a legitimate account on the specific TREK instance being targeted (it cannot be exploited by fully unauthenticated outsiders at the token-retrieval stage); instances with a small or single-user user base have minimal practical impact; non-sequential or UUID-based journey IDs would significantly raise exploitation difficulty, though the advisory does not confirm ID format protection exists in pre-3.1.0 versions.

The NVD CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is consistent with the description: the attack is network-reachable, requires no special conditions (AC:L), demands only a low-privilege authenticated account (PR:L), needs no victim interaction, and yields high confidentiality loss with no integrity or availability impact, producing a 6.5 medium base score. However, the practical risk is elevated beyond the numeric score for multi-tenant instances: the sequential ID enumeration removes any meaningful attack complexity, the stolen token permanently grants unauthenticated downstream access until rotated, and the exposed data set (GPS coordinates, mood journals, photo paths, captions) carries significant personal privacy implications. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. There is no CISA KEV listing and no known POC, indicating opportunistic exploitation has not been widely observed. SSVC signals: exploitation status is PoC-absent, the attack is automatable (simple loop over integer IDs), and the technical impact is partial (data read-only, no code execution). Overall assessment: real priority for any internet-facing or multi-tenant TREK 3.0.x deployment, but limited blast radius for single-user or private instances.

An attacker with any valid TREK account sends authenticated GET requests iterating /api/journeys/1/share-link, /api/journeys/2/share-link, and so on, collecting share tokens for journeys they do not own. They then make unauthenticated GET requests to /api/public/journey/{stolen-token} to read the victims' travel entries, GPS waypoints, mood logs, and gallery photo URLs - all without requiring the victims to take any action. No public proof-of-concept code has been identified, but the attack requires only basic HTTP requests and no specialized tooling.