CVE-2026-77321

TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. A token granted only an unrelated capability, such as weather:read, can receive trip metadata, member email addresses from server/src/services/tripService.ts, itinerary days, and accommodations for every trip accessible to the token's user. Cross-user trip authorization remains enforced, but the missing scope check defeats the consented least-privilege boundary and exposes trip content and third-party contact information to an MCP client that was not authorized to read it. This issue is fixed in version 3.3.0.

• CWE-200
• CWE-284
• CWE-862

• https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2
• https://github.com/liketrek/TREK/pull/1520
• https://github.com/liketrek/TREK/releases/tag/v3.3.0
• https://github.com/liketrek/TREK/security/advisories/GHSA-qvw8-w937-vcmq

Published

Sep 24, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77301adm-zip is a JavaScript library for creating and extracting …7.5
• CVE-2026-7731A security vulnerability has been detected in code-projects …6.3
• CVE-2026-77310jackson-databind contains the general-purpose data-binding f…5.3
• CVE-2026-77317SeaweedFS is a distributed storage system for files and blob…8.1
• CVE-2026-7732A vulnerability was detected in code-projects BloodBank Mana…6.3
• CVE-2026-77320TREK is a collaborative travel planner. Prior to 3.3.0, getS…5.3
• CVE-2026-77322SIPGO is a library for writing SIP services in the GO langua…7.5
• CVE-2026-7733A flaw has been found in funadmin up to 7.1.0-rc6. This affe…7.3
• CVE-2026-77337CakePHP Authentication is an authentication plugin for CakeP…9.1
• CVE-2026-77339Process Compose is a scheduler and orchestrator for non-cont…5.1
• CVE-2026-7734A vulnerability has been found in osrg GoBGP up to 4.3.0. Th…7.5
• CVE-2026-77341cpp-httplib is a C++ header-only HTTP/HTTPS library. In vers…5.3