CVE-2026-77320 mauriceboe CVE debrief

Who should care

Defenders responsible for TREK deployments, especially those using versions prior to 3.3.0, should assess their exposure and take steps to protect shared trip data. This includes verifying and restricting access to shared trip data, monitoring API requests, and updating to the latest version to prevent information disclosure. Additionally, defenders should review compensating controls for exposed systems and implement additional security measures toprotect

Why it matters

CVE-2026-77320 allows unauthorized access to sensitive trip data in TREK collaborative travel planner versions prior to 3.3.0. Defenders should verify and restrict access to shared trip data, monitor API requests, and update to the latest version to prevent information disclosure.

• Verify and restrict access to shared trip data to prevent unauthorized information disclosure
• Ensure that sensitive information is not inadvertently exposed through API responses
• Monitor API requests and responses for potential security issues
• Update TREK to version 3.3.0 or later to fix the vulnerability

Technical summary

The getSharedTripData function in server/src/services/shareService.ts returns sensitive trip data through a GET request to /api/shared/:token, even when the trip owner has disabled map sharing. This issue allows unauthorized access to location and route information. The vulnerability affects TREK collaborative travel planner versions prior to 3.3.0. Defenders should assess their exposure and take steps to protect shared trip data. The issue is fixed in version 3.3.0, but the extent of exploitation and affected deployments are not specified.

Defensive priority

Defenders should prioritize verifying and restricting access to shared trip data, especially for TREK versions prior to 3.3.0, and ensure that sensitive information is not inadvertently exposed through API responses.

Recommended defensive actions

• Verify TREK version and ensure it is updated to 3.3.0 or later
• Restrict access to shared trip data and validate token permissions
• Monitor API requests and responses for sensitive information exposure
• Implement additional security measures to protect location and route information
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in TREK versions prior to 3.3.0. The issue is fixed in version 3.3.0. However, the extent of exploitation and affected deployments are not specified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.