7 matches found
CVE-2026-77320
TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables sharemap. The client hides the map, but the public JSON response still...
CVE-2026-77320 TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)
TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables sharemap. The client hides the map, but the public JSON response still...
CVE-2026-77320 TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)
TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables sharemap. The client hides the map, but the public JSON response still...
CVE-2026-77320 TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)
TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables sharemap. The client hides the map, but the public JSON response still...
CVE-2026-77320
The collaborative travel planner TREK is vulnerable to an information disclosure flaw in versions prior to 3.3.0 . The getSharedTripData function in server/src/services/shareService.ts fails to respect the share_map permission on the server-side. Consequently, while the client UI may hide the map...
PT-2026-98225
Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.3.0 Description The getSharedTripData function in server/src/services/shareService.ts allows the retrieval of sensitive trip information via the 'GET /api/shared/:token' endpoint, even when the trip owner has disabled...
CVE-2026-77320: Exposure of Sensitive Information to an Unauthorized Actor
TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables sharemap. The client hides the map, but the public JSON response still...