CVE-2026-54509: TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journeysharetokens for another user's journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey's entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TREKto a version that resolves this vulnerability.Fixed in 3.1.0
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
Any authenticated TREK user can exploit it. The attacker does not need access to the target journey, but can enumerate sequential journey IDs to retrieve other users' share tokens.
What information can be exposed using a stolen share token?
The token enables unauthenticated access to the shared journey through the public journey endpoint. Exposed content includes entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers.
Which versions are affected and what version fixes the issue?
TREK versions from 3.0.0 until 3.1.0 are affected. The issue is fixed in version 3.1.0.