Mauriceboe Trek
11 CVEs affecting Mauriceboe Trek. Latest disclosed: 2026-09-24. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77294 | High | 8.1 | 2026-09-24 | TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llm_base_url through the settings API… |
CVE-2026-77293 | High | 7.1 | 2026-09-24 | TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated u… |
CVE-2026-40185 | High | 7.1 | 2026-04-10 | TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is… |
CVE-2026-54509 | Medium | 6.5 | 2026-08-20 | TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result o… |
CVE-2026-77320 | Medium | 5.3 | 2026-09-24 | TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and place… |
CVE-2026-45410 | Medium | 5.3 | 2026-05-28 | TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts vi… |
CVE-2026-77321 | Medium | 4.3 | 2026-09-24 | TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens wi… |
CVE-2026-62945 | Medium | 4.3 | 2026-08-20 | TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and ass… |
CVE-2026-40184 | Low | 3.7 | 2026-04-10 | TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2. |
CVE-2026-54508 | | 2026-08-20 | TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNa… | |
CVE-2026-54505 | | 2026-08-20 | TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into j… |