EUVD-2026-65475
GHSA-j7mw-g2xq-7xfh
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible proxy endpoint requires no credentials but high complexity to exploit; impact is limited to partial confidentiality of journey photos with no integrity, availability, or scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. Upgrading to version 3.1.0 will fix this issue. You should upgrade the affected component.
AnalysisAI
Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthenticated attackers to bypass share token validation in the validateShareTokenForAsset function, potentially exposing journey photos without a valid share token. The CVSS 4.0 score of 6.3 reflects high attack complexity that constrains practical exploitation despite requiring no authentication or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable `validateShareTokenForAsset` function must be reachable via the Journey Photo Proxy endpoint, which requires that the TREK instance is network-accessible and that journey photo sharing functionality is in use (i.e., journeys with photos exist on the instance). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.3) places this firmly in the medium range. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who knows or can guess a valid journey photo proxy URL sends a crafted HTTP request to the Journey Photo Proxy endpoint with a manipulated or absent share token. By exploiting the flawed token-validation logic in `validateShareTokenForAsset`, the attacker bypasses the authorization check and receives the proxied journey photo in the response. … |
| Remediation | Upgrade to TREK v3.1.0, available at https://github.com/liketrek/TREK/releases/tag/v3.1.0; the vendor explicitly states this release fixes the authorization bypass and strongly recommends updating every self-hosted instance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with
Share-link token theft in TREK versions 3.0.0 through 3.0.x allows any ordinary authenticated user to exfiltrate private
Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authenticati
Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OID
Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server i
Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-f
SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate under
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with fi
TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unau
Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI red
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today