Mauriceboe
Monthly
Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with low privileges to access and modify trip photos without proper authorization. The missing authorization checks on Immich trip photo management routes enable unauthorized data access (high confidentiality impact) and limited integrity compromise. Exploitation requires authenticated access but no user interaction, exploitable remotely over network with low attack complexity.
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with file-edit permission on any accessible trip to disclose reservation titles from private trips they do not own. By supplying attacker-controlled reservation_id, place_id, or assignment_id values to three file management API endpoints, the server joins the foreign reservation record in subsequent FILE_SELECT or getFileLinks() database queries and returns reservation_title in the response, crossing private trip boundaries. No public exploit code has been identified at time of analysis; vendor-released patch is confirmed in version 3.1.3.
Share-link token theft in TREK versions 3.0.0 through 3.0.x allows any ordinary authenticated user to exfiltrate private journey data belonging to other users. By iterating sequential journey IDs against the unguarded GET /api/journeys/:id/share-link endpoint, an attacker retrieves valid share tokens for journeys they do not own; those tokens then grant unauthenticated read access to the victim's travel entries, captions, GPS locations, moods, gallery photos, photo file paths, and asset identifiers via the public endpoint GET /api/public/journey/:token. No public exploit code or CISA KEV listing exists at time of analysis; the NVD CVSS scores this 6.5 medium, but the high confidentiality impact on personal travel data warrants prompt patching on any multi-tenant TREK deployment.
Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server into making blind GET requests against loopback addresses, RFC 1918 internal networks, or cloud instance metadata endpoints (e.g., 169.254.169.254). The root cause is that importGoogleList(), importNaverList(), and resolveGoogleMapsUrl() validate only the initial submitted URL via checkSsrf() but then call native fetch() with redirect:'follow', bypassing DNS-pinned safeFetch() on redirect hops. No public exploit code or CISA KEV entry has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects the authenticated prerequisite and blind (non-reflective) nature of the SSRF.
Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI redress attacks against authenticated collaborators when the Journey add-on is enabled. An authenticated trip owner embeds raw HTML in a trip title; the backend endpoint GET /api/journeys/suggestions returns it unsanitized, and the frontend renders it directly via React's dangerouslySetInnerHTML, bypassing output encoding. The default Content Security Policy blocks inline handlers and script execution, constraining impact to visual manipulation rather than full cross-site scripting; no public exploit or active exploitation has been identified at time of analysis.
TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unauthenticated remote attackers to enumerate and access private photo collections through direct URL access. The vulnerability is restricted to information disclosure with low impact due to attack complexity constraints, though it exposes sensitive travel-related imagery that users expect to be private.
Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with low privileges to access and modify trip photos without proper authorization. The missing authorization checks on Immich trip photo management routes enable unauthorized data access (high confidentiality impact) and limited integrity compromise. Exploitation requires authenticated access but no user interaction, exploitable remotely over network with low attack complexity.
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with file-edit permission on any accessible trip to disclose reservation titles from private trips they do not own. By supplying attacker-controlled reservation_id, place_id, or assignment_id values to three file management API endpoints, the server joins the foreign reservation record in subsequent FILE_SELECT or getFileLinks() database queries and returns reservation_title in the response, crossing private trip boundaries. No public exploit code has been identified at time of analysis; vendor-released patch is confirmed in version 3.1.3.
Share-link token theft in TREK versions 3.0.0 through 3.0.x allows any ordinary authenticated user to exfiltrate private journey data belonging to other users. By iterating sequential journey IDs against the unguarded GET /api/journeys/:id/share-link endpoint, an attacker retrieves valid share tokens for journeys they do not own; those tokens then grant unauthenticated read access to the victim's travel entries, captions, GPS locations, moods, gallery photos, photo file paths, and asset identifiers via the public endpoint GET /api/public/journey/:token. No public exploit code or CISA KEV listing exists at time of analysis; the NVD CVSS scores this 6.5 medium, but the high confidentiality impact on personal travel data warrants prompt patching on any multi-tenant TREK deployment.
Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server into making blind GET requests against loopback addresses, RFC 1918 internal networks, or cloud instance metadata endpoints (e.g., 169.254.169.254). The root cause is that importGoogleList(), importNaverList(), and resolveGoogleMapsUrl() validate only the initial submitted URL via checkSsrf() but then call native fetch() with redirect:'follow', bypassing DNS-pinned safeFetch() on redirect hops. No public exploit code or CISA KEV entry has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects the authenticated prerequisite and blind (non-reflective) nature of the SSRF.
Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI redress attacks against authenticated collaborators when the Journey add-on is enabled. An authenticated trip owner embeds raw HTML in a trip title; the backend endpoint GET /api/journeys/suggestions returns it unsanitized, and the frontend renders it directly via React's dangerouslySetInnerHTML, bypassing output encoding. The default Content Security Policy blocks inline handlers and script execution, constraining impact to visual manipulation rather than full cross-site scripting; no public exploit or active exploitation has been identified at time of analysis.
TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unauthenticated remote attackers to enumerate and access private photo collections through direct URL access. The vulnerability is restricted to information disclosure with low impact due to attack complexity constraints, though it exposes sensitive travel-related imagery that users expect to be private.