TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST [truncated]
The TREK collaborative travel planner has a vulnerability in versions 3.0.0 to 3.1.0. An authenticated user can access shared journey data without authorization via the GET /api/journeys/:id/share-link route. This is due to a lack of access checks in the getJourneyShareLink() function. The vulnerability was fixed in version 3.1.0. Users should verify their TREK version and apply patches or mitigations as [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T22:17:21.410Z and has not been modified since then. TREK versions prior to 3.1.0 have an SSRF vulnerability in importGoogleList(), importNaverList(), and resolveGoogleMapsUrl() due to insecure redirect handling. This allows an authenticated trip member to reach the list-import routes and any auth [truncated]
TREK collaborative travel planner versions prior to 3.0.18 contain a user enumeration vulnerability via timing side-channel. The login endpoint exhibits a measurable latency difference (~370 ms vs ~10 ms) based on whether a submitted email address exists in the database, caused by bcrypt password comparison being performed only for valid users. This ~14× timing discrepancy allows remote attackers to enume [truncated]
