CVE-2026-62945

Received Received - Intake

File Link Manipulation in TREK Travel Planner

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Subsequent reads through FILE_SELECT or getFileLinks() join the foreign reservation and return reservation_title, disclosing reservation existence and titles across private trip boundaries. This issue is fixed in version 3.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-62945

Affected Vendors & Products

Vendor	Product	Version / Range
trek	trek	to 3.1.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

TREK before version 3.1.3 allows authenticated users with file-edit permissions to link foreign reservations to trips they do not own by manipulating reservation_id, place_id, or assignment_id values. This bypasses verification checks, enabling unauthorized access to reservation titles across private trip boundaries through file operations.

Detection Guidance

This vulnerability involves unauthorized access to reservation titles across trip boundaries in TREK versions before 3.1.3. To detect it, check TREK server logs for suspicious POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id requests with foreign reservation IDs. Verify if responses include reservation_title from unrelated trips.

Impact Analysis

An attacker with file-edit access could view private reservation titles from trips they do not own, potentially exposing sensitive travel plans or itineraries. This could lead to information leakage or unauthorized knowledge of others' travel activities.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized access to reservation titles across private trip boundaries. Unauthorized disclosure of reservation data may constitute a breach of confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade TREK to version 3.1.3 or later to address the vulnerability in file upload, update, and link actions.

Hi! I’m here to help you understand CVE-2026-62945. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70