CVE-2026-77321: TREK MCP trip summary bypasses delegated OAuth read scopes
TREK is a collaborative travel planner. Prior to 3.3.0, the gettripsummary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. A token granted only an unrelated capability, such as weather:read, can receive trip metadata, member email addresses from server/src/services/tripService.ts, itinerary days, and accommodations for every trip accessible to the token's user. Cross-user trip authorization remains enforced, but the missing scope check defeats the consented least-privilege boundary and exposes trip content and third-party contact information to an MCP client that was not authorized to read it. This issue is fixed in version 3.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TREKto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Which deployments and OAuth tokens are affected?
TREK versions before 3.3.0 are affected when scoped OAuth MCP tokens can invoke the get_trip_summary tool. A token with an unrelated delegated capability, such as weather:read, can retrieve summary data for trips that its user can access.
What information can an unauthorized MCP client obtain?
The tool can return trip metadata, member email addresses, itinerary days, and accommodation information. It does not bypass cross-user trip authorization, so data exposure is limited to trips accessible to the token's user.
Does exploitation require user interaction or a privileged token?
No user interaction is required. An attacker needs a scoped OAuth MCP token for a user with access to trips; the token does not need the trips:read scope and may have only an unrelated capability.
What is the remediation?
Upgrade TREK to version 3.3.0, which fixes the missing trips:read scope requirement for get_trip_summary.