CVE-2026-77320

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77320
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77320.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77320
Aliases
  • GHSA-9hc8-p7gm-p7mx
Published
2026-09-24T18:05:13Z
Modified
2026-09-25T03:49:02Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)
Details

TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the map, but the public JSON response still includes the itinerary and place names, coordinates, addresses, descriptions, notes, and prices. Anyone holding the valid share token can therefore read location and route information that the owner explicitly chose not to share, although the random token remains required and the flaw does not permit modification. This issue is fixed in version 3.3.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200",
        "CWE-284",
        "CWE-602"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77320.json"
}
References

Affected packages

Git / github.com/liketrek/trek

Affected ranges

Type
GIT
Repo
https://github.com/liketrek/trek
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f9c992ec9363301762ac00e97747c1dd0fe37d6b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.3.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

plugin-sdk-v1.*
plugin-sdk-v1.3.0
plugin-sdk-v1.3.1
v2.*
v2.1.0
v2.3.5
v2.4.0
v2.5.0
v2.5.1
v2.5.2
v2.5.4
v2.5.5
v2.5.6
v2.5.7
v2.6.0
v2.6.1
v2.6.2
v2.7.0
v2.7.2
v2.8.0
v2.8.4
v2.9.10
v2.9.11
v2.9.12
v2.9.13
v2.9.14
v2.9.2
v2.9.4
v2.9.5
v2.9.6
v2.9.7
v2.9.8
v2.9.9
v3.*
v3.0.0
v3.0.1
v3.0.10
v3.0.11
v3.0.12
v3.0.13
v3.0.14
v3.0.15
v3.0.16
v3.0.17
v3.0.18
v3.0.19
v3.0.2
v3.0.20
v3.0.21
v3.0.22
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.2.0
v3.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77320.json"