TREK EUVD-2026-63642

Exploitation requires a valid TREK user account with file-edit permission on at least one trip accessible to the attacker - no admin or owner role is needed, only the file-edit grant on any trip (PR:L per CVSS). The attacker must supply a valid reservation_id, place_id, or assignment_id belonging to a target trip; if these identifiers are sequential integers they may be brute-forced, but UUID-based identifiers would require prior knowledge or leakage from another source. Disclosed information is limited to reservation_title fields only; full reservation content, authentication tokens, files, and other trip data are not exposed via this path. Standard multi-user TREK deployment with no special configuration is sufficient for exploitation - no non-default feature flag or specific infrastructure mode is required.

The CVSS 4.3 base score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately represents the limited blast radius: the attack is network-accessible with no special configuration and low complexity, but requires a valid authenticated session with file-edit rights on at least one trip (PR:L). Scope is unchanged (S:U) and impact is restricted to confidentiality at a low level - only reservation_title strings are disclosed, not full reservation content, credentials, or files. No CISA KEV listing is present and no public POC has been identified, placing real-world exploitation priority below actively exploited vulnerabilities of similar score. In multi-tenant deployments the privacy boundary violation is meaningful: itinerary details from private trips leak to unauthorized co-users. The risk is moderate for privacy-sensitive deployments and low for single-user or small trusted-team instances. No conflicting signals between CVSS and description text are apparent.

An authenticated TREK user who has been granted file-edit access to their own trip enumerates or guesses a valid reservation_id belonging to a different user's private trip, then submits a POST /api/trips/:tripId/files/:id/link request embedding that foreign identifier. When the server subsequently executes getFileLinks() or FILE_SELECT for any file on the attacker's trip, the ORM join returns the private trip's reservation_title in the JSON response, revealing itinerary details without any elevated privileges or special tooling beyond a standard HTTP client.