7.1

CVE-2026-40185

Missing Authorization on Immich Trip Photo Routes in TREK

TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mauriceboe ≫ Trek SwPlatformnode.js Version <= 2.7.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.11
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
security-advisories@github.com 7.1 2.8 4.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179
Patch
https://github.com/mauriceboe/TREK/releases/tag/v2.7.2
Release Notes
https://github.com/mauriceboe/TREK/security/advisories/GHSA-pcr3-6647-jh72
Vendor Advisory