CVE-2026-77321

Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description

TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. A token granted only an unrelated capability, such as weather:read, can receive trip metadata, member email addresses from server/src/services/tripService.ts, itinerary days, and accommodations for every trip accessible to the token's user. Cross-user trip authorization remains enforced, but the missing scope check defeats the consented least-privilege boundary and exposes trip content and third-party contact information to an MCP client that was not authorized to read it. This issue is fixed in version 3.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-77321

EUVD

EUVD-2026-86339

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-77321 is a vulnerability in the TREK travel planner software where the get_trip_summary function returns sensitive trip data including member emails, itineraries, and accommodations even when the OAuth token only has unrelated scopes like weather:read. The function fails to enforce required scopes such as trips:read, breaking the least-privilege principle.

Detection Guidance

Check OAuth token scopes for MCP clients using the get_trip_summary tool. Verify if tokens with limited scopes like weather:read can access trip data. Inspect server logs for unauthorized trip data access attempts.

Impact Analysis

An attacker with a narrowly scoped OAuth token could access full trip metadata, member email addresses, itinerary details, and accommodations for trips they are authorized to view. This exposes personally identifiable information and violates expected access controls.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personally identifiable information without proper authorization. It undermines data minimization and access control requirements under these regulations.

Mitigation Strategies

Upgrade TREK to version 3.3.0 or later. Ensure all MCP tools enforce scope checks consistently. Review and restrict OAuth token permissions to minimum required scopes.

Hi! I’m here to help you understand CVE-2026-77321. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70