Threat Intelligence Database

CVE-2026-62945 is an authorization bypass vulnerability in mauriceboe TREK prior to version 3.1.3. The issue allows authenticated users with file-edit permissions on any accessible trip to link files to foreign reservations, places, or assignments without proper verification that these objects belong to the trip. This leads to unauthorized disclosure of reservation titles across private trip boundaries. The vulnerability is fixed in version 3.1.3.

CVE-2026-54509 is a missing authorization vulnerability in mauriceboe TREK versions 3.0.0 up to but not including 3.1.0. The GET /api/journeys/:id/share-link endpoint does not verify if the authenticated user has permission to access the requested journey. This allows any authenticated user to enumerate journey IDs and obtain share tokens for other users' journeys. These tokens enable unauthenticated access to shared journey details such as entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. The issue is resolved in version 3.1.0.

CVE-2026-54508 is a Server-Side Request Forgery (SSRF) vulnerability in mauriceboe TREK, a collaborative travel planner. Versions prior to 3.1.0 improperly validate URLs during certain list import and URL resolution functions, allowing authenticated users to cause the server to make blind GET requests to internal or sensitive network addresses without revalidation. This could enable access to internal services such as loopback, RFC 1918 private addresses, or cloud metadata endpoints. The issue is fixed in version 3.1.0.

CVE-2026-54505 is a cross-site scripting (XSS) vulnerability in the TREK collaborative travel planner prior to version 3.1.0. When the Journey add-on is enabled, unescaped user input from trip titles is rendered directly into the DOM using dangerouslySetInnerHTML, allowing a trip owner to inject HTML that is then displayed to collaborators. Although the default Content Security Policy mitigates script execution, this flaw can enable content spoofing and UI redress attacks. The issue is fixed in version 3.1.0.

TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before returning a 401 Unauthorized, adding ~370 ms of latency. When the email did not exist, the backend returned immediately (~10 ms). This ~14× timing difference could be detected without any difference in HTTP status codes or response bodies. This vulnerability is fixed in 3.0.18.

TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2.

TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2.