CVE-2026-62945

{"id": "CVE-2026-62945", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62945", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T15:41:53.264990Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mauriceboe", "product": "TREK", "versions": [{"status": "affected", "version": "< 3.1.3"}]}]}], "published": "2026-08-20T22:17:46.740", "references": [{"url": "https://github.com/liketrek/TREK/commit/03cdb4d27689922460ba87085d04b426d4d40d26", "source": "security-advisories@github.com"}, {"url": "https://github.com/liketrek/TREK/pull/1324", "source": "security-advisories@github.com"}, {"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-r4cp-666p-8f69", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Subsequent reads through FILE_SELECT or getFileLinks() join the foreign reservation and return reservation_title, disclosing reservation existence and titles across private trip boundaries. This issue is fixed in version 3.1.3."}, {"lang": "es", "value": "TREK es un planificador de viajes colaborativo. Antes de la versi\u00f3n 3.1.3, las acciones de carga, actualizaci\u00f3n y enlace de archivos de TREK aceptan valores de reservation_id, place_id y assignment_id controlados por el atacante sin usar findForeignLinkTarget() para verificar que el objeto referenciado pertenece al viaje del archivo. Un usuario autenticado con permiso de edici\u00f3n de archivos en cualquier viaje accesible puede enviar un identificador de reserva externo a trav\u00e9s de POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, o PUT /api/trips/:tripId/files/:id. Las lecturas posteriores a trav\u00e9s de FILE_SELECT o getFileLinks() unen la reserva externa y devuelven reservation_title, revelando la existencia y los t\u00edtulos de las reservas a trav\u00e9s de los l\u00edmites de viajes privados. Este problema est\u00e1 solucionado en la versi\u00f3n 3.1.3."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security-advisories@github.com"}