liketrek TREK CVE-2026-78864

Exploitation requires a valid authenticated session with at least low-level user privileges, as confirmed by PR:L in the CVSS 4.0 vector - unauthenticated anonymous exploitation is not possible. The attacker must hold an account on the target self-hosted TREK instance. The endpoint is network-accessible (AV:N) with low attack complexity (AC:L) and no required user interaction beyond the attacker's own crafted request (UI:N, AT:N). No non-default configuration is required - the Journey Entry Update feature is a core application function. Key limiting factors: mandatory authentication before reaching the vulnerable endpoint, the self-hosted deployment model (not exposed as a public SaaS), and the niche footprint of TREK in production environments. Scope is contained - no cross-system impact per SC:N/SI:N/SA:N.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects the constrained but real threat posture: the endpoint is network-reachable with low attack complexity, but exploitation is gated behind an authenticated session (PR:L), ruling out unauthenticated mass exploitation. Confidentiality, integrity, and availability impact are all rated Low on the vulnerable system with no subsequent-system impact, consistent with a CWE-89 flaw that allows data manipulation within the application's own database scope rather than full compromise. No CISA KEV listing and no public POC code have been identified, meaning exploitation probability is currently low. EPSS data was not included in the provided sources and cannot be assessed. The private-disclosure model and the authentication prerequisite together suggest this is a moderate-priority patch-when-able item for self-hosted operators, not an emergency response situation - though the co-disclosure of a critical authentication bypass in the same 3.1.0 release makes upgrading urgently advisable for that separate reason.

An authenticated TREK user submits a crafted journey entry update request with SQL metacharacters embedded in a controllable field targeting the journeyService.updateEntry endpoint. The injected payload alters the underlying SQL query, potentially allowing the attacker to read other users' journey records, modify data outside their own scope, or enumerate database contents. No public exploit code has been identified at time of analysis.