CVE-2026-77320
Received Received - Intake

TREK Travel Planner Information Exposure via Shared Trip Data

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the map, but the public JSON response still includes the itinerary and place names, coordinates, addresses, descriptions, notes, and prices. Anyone holding the valid share token can therefore read location and route information that the owner explicitly chose not to share, although the random token remains required and the flaw does not permit modification. This issue is fixed in version 3.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-77320
EUVD
EUVD-2026-86340

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in TREK travel planner allows unauthorized access to trip itinerary details through a shared token. Even when a user disables map sharing, the API endpoint /api/shared/:token still returns sensitive data like itinerary, place names, coordinates, addresses, descriptions, notes, and prices. The flaw does not allow modification of data but exposes information the owner intended to keep private.

Detection Guidance

Check if GET /api/shared/:token endpoints return sensitive itinerary data even when share_map is disabled. Monitor network traffic for unauthorized access to shared trip data using tools like curl to query the endpoint with valid tokens.

Impact Analysis

If you use TREK and share a trip link, attackers with the token could access your itinerary details without your knowledge. This includes sensitive location data, routes, and personal notes. While the token is required for access, the exposure of private trip information could lead to privacy risks or targeted attacks based on your travel plans.

Compliance Impact

This vulnerability may violate privacy regulations like GDPR or HIPAA by exposing personal location data without explicit user consent. Organizations using TREK could face compliance violations if user data is inadvertently shared against their privacy settings, potentially leading to legal or reputational consequences.

Mitigation Strategies

Upgrade TREK to version 3.3.0 or later to patch the issue. Review and revoke any existing share tokens if they are no longer needed. Ensure no sensitive trip data is exposed through the affected endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77320. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart