Vulnerability details

CVE-2026-77293

mauriceboe TREK

TREK: Cross-user note-file deletion (IDOR / Broken Access Control)

CVSS 3.1

7.1High

Official description

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and file identifiers without requiring the file to belong to that trip. A user with edit access to any trip can submit identifiers belonging to another user's trip and permanently delete that note-file attachment. Sequential identifiers make broad targeting practical, while attachment read operations remain trip-scoped and are not affected. This issue is fixed in version 3.3.0.

CVSS scores

Score	Version	Source	Vector
7.1High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L`

Affected products

Vendor	Product	Versions	Source
mauriceboe	TREK	< 3.3.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/liketrek/TREK/pull/1520 x_refsource_MISC
https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2 x_refsource_MISC
https://github.com/liketrek/TREK/releases/tag/v3.3.0 x_refsource_MISC
https://github.com/liketrek/TREK/security/advisories/GHSA-cjc5-722j-vvmf x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-24
Last updated: 2026-09-24
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.38%

Probability of exploitation in 30 days

32.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-639
Authorization Bypass Through User-Controlled Key
CWE-862
Missing Authorization