CVE-2026-77320 Missing authorization in TREK
Attackers with a valid share token can access hidden itinerary and location data in TREK because the server ignores the share_map permission setting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77320?
CVE-2026-77320 is a medium-severity missing authorization vulnerability in mauriceboe TREK, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the map, but the public JSON response still includes the itinerary and place names, coordinates, addresses, descriptions, notes, and prices. Anyone holding the valid share token can therefore read location and route information that the owner explicitly chose not to share, although the random token remains required and the flaw does not permit modification. This issue is fixed in version 3.3.0.
Which versions are affected by CVE-2026-77320?
How do I fix CVE-2026-77320?
No fix has been published for CVE-2026-77320 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-77320 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77320 exists.
Sources
Also known as GHSA-9hc8-p7gm-p7mx.