CVE-2026-78887

liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization

State: Published
Severity: 6.3 Medium
Published: Aug 25, 2026
Updated: Aug 25, 2026
Reserved: Aug 25, 2026

Description

A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. Upgrading to version 3.1.0 will fix this issue. You should upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X	VulDB
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C	VulDB
3.0	3.7 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C	VulDB
2.0	2.6 Low	AV:N/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-863 Incorrect Authorization
CWE-285 Improper Authorization

Affected Products

Product	Versions
TREKliketrek	3.0.0Affected 3.0.1Affected 3.0.2Affected 3.0.3Affected 3.0.4Affected 3.0.5Affected 3.0.6Affected 3.0.7Affected 3.0.8Affected 3.0.9Affected 3.0.10Affected 3.0.11Affected 3.0.12Affected 3.0.13Affected 3.0.14Affected 3.0.15Affected 3.0.16Affected 3.0.17Affected 3.0.18Affected 3.0.19Affected 3.0.20Affected 3.0.21Affected 3.0.22Affected 3.1.0Not affected

References

VDB-394943 | liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorizationvdb-entrytechnical-description
VDB-394943 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-78887 | CVE Analysis and Reportthird-party-advisory
Submit #886933 | mauriceboe TREK <= 3.0.22 Privilege Escalationthird-party-advisory
https://github.com/mauriceboe/TREK/security/advisories/GHSA-24x9-fcj9-vp6wrelated
https://github.com/liketrek/TREK/releases/tag/v3.1.0patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.