CVE-2026-54509: Mauriceboe Trek

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user's journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey's entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0.

Affected products

• Mauriceboe Trek: from 3.0.0, before 3.1.0 (fixed in 3.1.0)

Published 2026-08-20. Last modified 2026-09-18.