CVE-2026-62945: CWE-639: Authorization Bypass Through User-Controlled Key in mauriceboe TREK
Description
CVE-2026-62945 is an authorization bypass vulnerability in mauriceboe TREK prior to version 3.1.3. The issue allows authenticated users with file-edit permissions on any accessible trip to link files to foreign reservations, places, or assignments without proper verification that these objects belong to the trip. This leads to unauthorized disclosure of reservation titles across private trip boundaries. The vulnerability is fixed in version 3.1.3.
CVSS v3.1
Score 4.3medium
Affected software
mauriceboe
TREK
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
TREK, a collaborative travel planner, prior to version 3.1.3, improperly validates user-controlled keys (reservation_id, place_id, assignment_id) during file upload, update, and link actions. The system fails to use findForeignLinkTarget() to confirm that referenced objects belong to the trip associated with the file. As a result, an authenticated user with file-edit permission on any accessible trip can submit foreign reservation identifiers via API endpoints (POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, PUT /api/trips/:tripId/files/:id). Subsequent file reads join these foreign reservations and disclose reservation titles, leaking information across private trip boundaries. This vulnerability is addressed in TREK version 3.1.3.
Potential Impact
An authenticated user with file-edit permissions on any accessible trip can bypass authorization controls to link files to reservations belonging to other trips. This leads to unauthorized information disclosure of reservation existence and titles across private trip boundaries. The vulnerability does not impact integrity or availability, only confidentiality to a limited extent.
Mitigation Recommendations
Upgrade TREK to version 3.1.3 or later, where this authorization bypass vulnerability is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-14T22:32:17.731Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a877787acd9273b492c5e4a
Added to database: 08/20/2026, 21:54:15 UTC
Last enriched: 09/11/2026, 03:48:39 UTC
Last updated: 10/05/2026, 06:48:17 UTC
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.