liketrek TREK CVE-2026-78887

The vulnerable validateShareTokenForAsset function must be reachable via the Journey Photo Proxy endpoint, which requires that the TREK instance is network-accessible and that journey photo sharing functionality is in use (i.e., journeys with photos exist on the instance). No authentication is required (PR:N in the CVSS 4.0 vector), but high attack complexity (AC:H) indicates that successful exploitation requires satisfying conditions beyond a trivial request - likely knowledge of specific asset identifiers or a particular request format not disclosed in public sources. Exploitation is limited to confidentiality of journey photos; no integrity or availability impact is possible through this path. The vulnerability does not affect TREK instances where the Journey Photo Proxy is isolated behind a network boundary that prevents external access.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.3) places this firmly in the medium range. AC:H is the primary mitigating factor - exploitation requires specific conditions beyond a simple network request, meaningfully reducing the realistic attacker pool. The VC:L rating indicates limited confidentiality impact (journey photos), with no integrity, availability, or scope-change impact. There is no CISA KEV listing and no publicly known exploit code, so this remains a theoretical-to-opportunistic risk rather than an active threat. EPSS data was not provided; given the high complexity and niche self-hosted deployment model, real-world exploitation probability is assessed as low. The vulnerability is nonetheless worth patching promptly because TREK instances are self-hosted and may not receive automated updates, and the fix is bundled into a major release that resolves 17 additional issues.

An attacker who knows or can guess a valid journey photo proxy URL sends a crafted HTTP request to the Journey Photo Proxy endpoint with a manipulated or absent share token. By exploiting the flawed token-validation logic in validateShareTokenForAsset, the attacker bypasses the authorization check and receives the proxied journey photo in the response. High attack complexity means the attacker likely needs to satisfy additional preconditions - such as knowledge of internal resource identifiers or specific request structure - reducing opportunistic mass exploitation but not eliminating targeted attempts.