CVE-2026-62945

TREK (a collaborative travel planner) prior to 3.1.3 contains an authorization bypass in its file upload, update, and link endpoints. The affected actions accept attacker-controlled reservation_id, place_id, and assignment_id values without invoking findForeignLinkTarget() to verify that the refe...