CVE-2026-40185

TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179	Patch
https://github.com/mauriceboe/TREK/releases/tag/v2.7.2	Release Notes
https://github.com/mauriceboe/TREK/security/advisories/GHSA-pcr3-6647-jh72	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mauriceboe:trek:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) TREK es un planificador de viajes colaborativo. Antes de la versión 2.7.2, TREK carecía de controles de autorización en las rutas de gestión de fotos de viajes de Immich. Esta vulnerabilidad está corregida en la versión 2.7.2.

Information

Published : 2026-04-10 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40185

Mitre link : CVE-2026-40185

CVE.ORG link : CVE-2026-40185

JSON object : View

Products Affected

mauriceboe

trek

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-40185", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40185", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T15:08:28.395142Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mauriceboe", "product": "TREK", "versions": [{"status": "affected", "version": "< 2.7.2"}]}]}], "published": "2026-04-10T20:16:23.573", "references": [{"url": "https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mauriceboe/TREK/releases/tag/v2.7.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-pcr3-6647-jh72", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2."}, {"lang": "es", "value": "TREK es un planificador de viajes colaborativo. Antes de la versi\u00f3n 2.7.2, TREK carec\u00eda de controles de autorizaci\u00f3n en las rutas de gesti\u00f3n de fotos de viajes de Immich. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.7.2."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mauriceboe:trek:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "FF5D262A-7F86-423E-9001-27183BE3840F", "versionEndIncluding": "2.7.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}