CVE-2026-77321 mauriceboe CVE debrief

Who should care

Defenders responsible for TREK deployments should assess exposure and prioritize upgrading to version 3.3.0 to prevent unauthorized access to sensitive trip information. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the affected scope and review compensating controls for exposed systems.

Why it matters

Defenders should prioritize verifying and upgrading to TREK version 3.3.0 to prevent unauthorized access to sensitive trip information. The vulnerability allows MCP clients with unrelated capabilities to receive trip metadata, member email addresses, itinerary days, and accommodations for every trip accessible to the token's user. Cross-user trip authorization remains enforced, but the missing scope check defeats the consented least-privilege boundary.

• Potential unauthorized access to trip metadata and third-party contact information
• Defeat of consented least-privilege boundary for MCP clients
• Exposure of trip content and third-party contact information to unauthorized MCP clients

Technical summary

The get_trip_summary tool in TREK server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. This allows MCP clients with unrelated capabilities to receive trip metadata, member email addresses, itinerary days, and accommodations for every trip accessible to the token's user. The missing scope check defeats the consented least-privilege boundary and exposes trip content and third-party contact information to an MCP client that was not authorized to read it.

Defensive priority

Defenders should prioritize verifying and upgrading to TREK version 3.3.0 to prevent unauthorized access to sensitive trip information.

Recommended defensive actions

• Verify and upgrade to TREK version 3.3.0
• Review and restrict access to trip metadata and third-party contact information
• Monitor for potential unauthorized access to sensitive trip information
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source references provide details on the vulnerability and its fix. However, additional information on potential exploitation and affected systems is limited. Defenders should verify the affected scope and review compensating controls for exposed systems while remediation is scheduled and verified. The CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessment. Review of the official advisory or CVE record is necessary to validate affected scope, severity, and vendor patch

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.