CVE-2026-77293

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and file identifiers without requiring the file to belong to that trip. A user with edit access to any trip can submit identifiers belonging to another user's trip and permanently delete that note-file attachment. Sequential identifiers make broad targeting practical, while attachment read operations remain trip-scoped and are not affected. This issue is fixed in version 3.3.0.

• CWE-639
• CWE-862

• https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2
• https://github.com/liketrek/TREK/pull/1520
• https://github.com/liketrek/TREK/releases/tag/v3.3.0
• https://github.com/liketrek/TREK/security/advisories/GHSA-cjc5-722j-vvmf
• https://github.com/liketrek/TREK/security/advisories/GHSA-cjc5-722j-vvmf

Published

Sep 24, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77272MCP Atlassian is a Model Context Protocol (MCP) server for A…5.4
• CVE-2026-77274MCP Atlassian is a Model Context Protocol (MCP) server for A…8.8
• CVE-2026-7728A vulnerability was identified in ryanjoachim mcp-rtfm 0.1.0…6.3
• CVE-2026-77281Caddy is an extensible server platform that uses TLS by defa…6.5
• CVE-2026-77285OpenBao is an open source identity-based secrets management …2.4
• CVE-2026-7729A security flaw has been discovered in pixelsock directus-mc…6.3
• CVE-2026-77294TREK is a collaborative travel planner. Prior to 3.3.0, TREK…8.1
• CVE-2026-77298SeaweedFS is a distributed storage system for files and blob…8.7
• CVE-2026-7730A weakness has been identified in privsim mcp-test-runner 0.…6.3
• CVE-2026-77301adm-zip is a JavaScript library for creating and extracting …7.5
• CVE-2026-7731A security vulnerability has been detected in code-projects …6.3
• CVE-2026-77310jackson-databind contains the general-purpose data-binding f…5.3