CVE-2026-78863

A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfa_token Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version 3.1.0 is recommended to address this issue. Upgrading the affected component is recommended.

CVSS v3 6.3 MEDIUM
CVSS v2.0 6.5 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/liketrek/TREK/releases/tag/v3.1.0
https://github.com/mauriceboe/TREK/security/advisories/GHSA-mjh4-w6fq-54qm
https://vuldb.com/cve/CVE-2026-78863
https://vuldb.com/submit/886929
https://vuldb.com/vuln/394939
https://vuldb.com/vuln/394939/cti

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-25 11:16

Updated : 2026-08-27 17:20

NVD link : CVE-2026-78863

Mitre link : CVE-2026-78863

CVE.ORG link : CVE-2026-78863

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-78863", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78863", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T15:05:53.392339Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:liketrek:trek:*:*:*:*:*:*:*:*"], "vendor": "liketrek", "modules": ["Pre-2FA mfa_token Handler"], "product": "TREK", "versions": [{"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.1"}, {"status": "affected", "version": "3.0.2"}, {"status": "affected", "version": "3.0.3"}, {"status": "affected", "version": "3.0.4"}, {"status": "affected", "version": "3.0.5"}, {"status": "affected", "version": "3.0.6"}, {"status": "affected", "version": "3.0.7"}, {"status": "affected", "version": "3.0.8"}, {"status": "affected", "version": "3.0.9"}, {"status": "affected", "version": "3.0.10"}, {"status": "affected", "version": "3.0.11"}, {"status": "affected", "version": "3.0.12"}, {"status": "affected", "version": "3.0.13"}, {"status": "affected", "version": "3.0.14"}, {"status": "affected", "version": "3.0.15"}, {"status": "affected", "version": "3.0.16"}, {"status": "affected", "version": "3.0.17"}, {"status": "affected", "version": "3.0.18"}, {"status": "affected", "version": "3.0.19"}, {"status": "affected", "version": "3.0.20"}, {"status": "affected", "version": "3.0.21"}, {"status": "affected", "version": "3.0.22"}, {"status": "unaffected", "version": "3.1.0"}]}]}], "published": "2026-08-25T11:16:54.627", "references": [{"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0", "source": "cna@vuldb.com"}, {"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-mjh4-w6fq-54qm", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-78863", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/886929", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/394939", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/394939/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfa_token Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version 3.1.0 is recommended to address this issue. Upgrading the affected component is recommended."}], "lastModified": "2026-08-27T17:20:43.797", "sourceIdentifier": "cna@vuldb.com"}