CVE-2026-78887: medium-severity vulnerability in liketrek TREK
liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.5%
A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. Upgrading to version 3.1.0 will fix this issue. You should upgrade the affected component.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Affected products
liketrek · TREKRelated CVEs — liketrek TREK
In the same product, most dangerous first.
CVE-2026-78885MEDIUMliketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authenticationEPSS 0.6%CVE-2026-78886MEDIUMliketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversalEPSS 0.6%CVE-2026-78863MEDIUMliketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authenticationEPSS 0.5%CVE-2026-85738MEDIUMTREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)EPSS 0.4%CVE-2026-78864MEDIUMliketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injectionEPSS 0.3%