What’s Vulnerable › Vulnerabilities

CVE-2026-54509: TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-20 · updated 2026-10-18
• Weakness: CWE-862

Description

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user's journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey's entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0.

Affected products

• mauriceboe TREK: from 3.0.0, < 3.1.0

References

• https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11
• https://github.com/liketrek/TREK/pull/1185
• https://github.com/liketrek/TREK/releases/tag/v3.1.0
• https://github.com/liketrek/TREK/security/advisories/GHSA-mx6m-qxv8-w624
• https://github.com/liketrek/TREK/security/advisories/GHSA-mx6m-qxv8-w624

Get alerted when CVE-2026-54509 or the next vulnerability affects your stack