CVE-2026-78887: liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization
A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. Upgrading to version 3.1.0 will fix this issue. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
liketrek TREK Journey Photo Proxy (validateShareTokenForAsset)to a version that resolves this vulnerability.Fixed in 3.1.0
Event History
Frequently Asked Questions
Which deployments are affected?
liketrek TREK Journey Photo Proxy deployments using TREK versions up to and including 3.0.22 are affected. Version 3.1.0 fixes the issue.
Can this be exploited remotely, and does an attacker need credentials?
The attack can be launched remotely, and the provided vector indicates no privileges or user interaction are required. Exploitation is described as high complexity and difficult.
What is the impact of successful exploitation?
Successful manipulation can cause incorrect authorization in validateShareTokenForAsset. The stated impact is limited to low confidentiality impact, with no integrity or availability impact listed.
What should teams do if they are running an affected version?
Upgrade the affected Journey Photo Proxy component to TREK version 3.1.0. No alternative mitigation or detection method is provided.