CVE-2026-54509

Received Received - Intake

Authentication Bypass in TREK Travel Planner

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user's journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey's entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-54509

Affected Vendors & Products

Vendor	Product	Version / Range
trek	collaborative_travel_planner	From 3.0.0 (inc) to 3.1.0 (inc)
trek	collaborative_travel_planner	3.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability exists in TREK, a collaborative travel planner, between versions 3.0.0 and 3.1.0. It allows any authenticated user to access another user's shared journey data by guessing sequential journey IDs. The flaw is in the GET /api/journeys/:id/share-link route which returns a share link without verifying if the requester owns the journey. The link grants access to sensitive data like entries, locations, and photos.

Detection Guidance

Check for unauthorized access to journey share tokens by monitoring GET requests to /api/journeys/:id/share-link and GET /api/public/journey/:token endpoints. Look for unusual sequential ID enumeration attempts or unexpected data exposure in logs.

Impact Analysis

If you use TREK versions 3.0.0 to 3.1.0, an attacker could access your shared journey data even if they are not the owner. This includes personal entries, locations, photos, and other sensitive information. The attacker only needs to be an authenticated user and guess sequential IDs.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's privacy rules. It may result in data breaches, exposing sensitive user information and potentially leading to legal penalties or compliance violations.

Mitigation Strategies

Upgrade to TREK version 3.1.0 or later to patch the vulnerability. If immediate upgrade is not possible, restrict access to the /api/journeys/:id/share-link route and validate user permissions before sharing journey tokens.

Hi! I’m here to help you understand CVE-2026-54509. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70