EUVD-2026-63639Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
PR:L because any authenticated TREK account suffices; C:H because full journey data including locations and photos is exposed; no integrity or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user's journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey's entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0.
AnalysisAI
Share-link token theft in TREK versions 3.0.0 through 3.0.x allows any ordinary authenticated user to exfiltrate private journey data belonging to other users. By iterating sequential journey IDs against the unguarded GET /api/journeys/:id/share-link endpoint, an attacker retrieves valid share tokens for journeys they do not own; those tokens then grant unauthenticated read access to the victim's travel entries, captions, GPS locations, moods, gallery photos, photo file paths, and asset identifiers via the public endpoint GET /api/public/journey/:token. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated TREK user account on the target instance - any ordinary registered user qualifies, as no elevated role or admin privilege is needed (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is consistent with the description: the attack is network-reachable, requires no special conditions (AC:L), demands only a low-privilege authenticated account (PR:L), needs no victim interaction, and yields high confidentiality loss with no integrity or availability impact, producing a 6.5 medium base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with any valid TREK account sends authenticated GET requests iterating /api/journeys/1/share-link, /api/journeys/2/share-link, and so on, collecting share tokens for journeys they do not own. They then make unauthenticated GET requests to /api/public/journey/{stolen-token} to read the victims' travel entries, GPS waypoints, mood logs, and gallery photo URLs - all without requiring the victims to take any action. … |
| Remediation | Upgrade to TREK version 3.1.0, available at https://github.com/liketrek/TREK/releases/tag/v3.1.0; this is the vendor-confirmed fix per the GitHub security advisory GHSA-mx6m-qxv8-w624 and commit ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11 (https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with
Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authenticati
Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OID
Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthentica
Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server i
Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-f
SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate under
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with fi
TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unau
Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI red
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today