In mauriceboe TREK versions before 3.3.0, the getSharedTripData function in server/src/services/shareService.ts returns detailed trip data including days, assignments, dayNotes, and places through the GET /api/shared/:token endpoint regardless of the trip owner's share_map setting. Although the client hides the map UI when sharing is disabled, the underlying JSON response still contains sensitive itinerary details such as location names, coordinates, addresses, descriptions, notes, and prices. This results in exposure of sensitive information to unauthorized actors who possess the share token. The vulnerability does not permit data modification. The issue is resolved in version 3.3.0.

An attacker with a valid share token can access sensitive itinerary and location information that the trip owner intended to keep private by disabling map sharing. This exposure could lead to privacy violations but does not allow data modification or other integrity or availability impacts. The confidentiality impact is limited to information disclosure.

Upgrade to mauriceboe TREK version 3.3.0 or later, where this issue is fixed. Prior to upgrading, be aware that disabling share_map does not prevent exposure of itinerary details via the API. No other mitigations are documented.