CVE-2026-62945 mauriceboe CVE debrief

Who should care

Users of TREK collaborative travel planner, particularly those with file-edit permissions, should be aware of this vulnerability and take steps to protect their installations. This includes reviewing access controls, ensuring that file-edit permissions are only granted to necessary personnel, and monitoring for suspicious activity related to file uploads, updates, and links. Additionally, users should verify that they are running version 3.1.3 or later of the TREK software and consider restricting file-edit permissions to minimize the potential impact of this vulnerability. It is also recommended to track exceptions, retest remediated assets, and close the item only after evidence is documented. Users should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Planning vendor-supported updates or mitigations through normal change control where exposure is confirmed is also crucial. Reviewing compensating controls for exposed systems while remediation is scheduled and verified can help minimize the risk. Checking relevant monitoring, detection, and logs for exposed assets that need extra review is also important. Finally, users should be aware of the potential for authenticated users with file-edit permissions on accessible trips to exploit this issue to disclose reservation existence and titles across private trip boundaries, and take steps to mitigate this risk. This may involve implementing additional security measures, such as monitoring for unusual activity or restricting access to sensitive data. By taking these steps, users can help protect their TREK installations from potential exploitation of this vulnerability. The CVE record and NVD entry provide details about the vulnerability in TREK, a collaborative travel planner. Limited information is available about the specific impact and affected configurations, so users should exercise caution and take steps to verify the vulnerability and its potential impact on their systems. Users should also consider the potential for this type

Technical summary

TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier, disclosing reservation existence and titles across private trip boundaries.

Defensive priority

Authenticated users with file-edit permissions on accessible trips may be able to exploit this issue to disclose reservation existence and titles across private trip boundaries.

Recommended defensive actions

• Inventory TREK installations and verify that they are running version 3.1.3 or later.
• Restrict file-edit permissions to minimize the potential impact of this vulnerability.
• Monitor for unusual activity related to file uploads, updates, and links in TREK.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in TREK, a collaborative travel planner. The issue is fixed in version 3.1.3. Limited information is available about the specific impact and affected configurations.

Official resources