CVE-2026-54509

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user's journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey's entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0.

• CWE-862

• https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11
• https://github.com/liketrek/TREK/pull/1185
• https://github.com/liketrek/TREK/releases/tag/v3.1.0
• https://github.com/liketrek/TREK/security/advisories/GHSA-mx6m-qxv8-w624
• https://github.com/liketrek/TREK/security/advisories/GHSA-mx6m-qxv8-w624

Published

Aug 20, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54503plone.app.textfield provides a zope.schema-style field type …4.3
• CVE-2026-54504MCP Documentation Server is a local-first document managemen…8.8
• CVE-2026-54505TREK is a collaborative travel planner. Prior to 3.1.0, when…2
• CVE-2026-54506Vvveb is a powerful and easy to use CMS with page builder to…7.6
• CVE-2026-54507Vvveb is a powerful and easy to use CMS with page builder to…8.4
• CVE-2026-54508TREK is a collaborative travel planner. Prior to 3.1.0, TREK…5.3
• CVE-2026-5451The Extensions for Leaflet Map plugin for WordPress is vulne…6.4
• CVE-2026-54510Speakr is a personal, self-hosted web application designed f…7.1
• CVE-2026-54511LogTape is an unobtrusive logging library. Prior to 1.3.11, …8.6
• CVE-2026-54512jackson-databind contains the general-purpose data-binding f…8.1
• CVE-2026-54513jackson-databind contains the general-purpose data-binding f…8.1
• CVE-2026-54514jackson-databind contains the general-purpose data-binding f…5.3