Skip to contentMauriceboe Trek vulnerabilities
- liketrek trekTREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)CVE-2026-857386.3 Medium
- mauriceboe trekTREK: Cross-user note-file deletion (IDOR / Broken Access Control)CVE-2026-772937.1 High
- mauriceboe trekTREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)CVE-2026-773205.3 Medium
- mauriceboe trekTREK MCP trip summary bypasses delegated OAuth read scopesCVE-2026-773214.3 Medium
- mauriceboe trekTREK: Server-Side Request Forgery via User-Configurable LLM Base URLCVE-2026-772948.1 High
- liketrek trekliketrek TREK Journey Photo Proxy validateShareTokenForAsset authorizationCVE-2026-788876.3 Medium
- liketrek trekliketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversalCVE-2026-788866.3 Medium
- liketrek trekliketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authenticationCVE-2026-788856.3 Medium
- liketrek trekliketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injectionCVE-2026-788645.3 Medium
- liketrek trekliketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authenticationCVE-2026-788635.3 Medium
- mauriceboe trekTREK: Cross-trip reservation title disclosure via file linksCVE-2026-629454.3 Medium
- mauriceboe trekTREK IDOR: any authenticated user can read another user's journey share token (full journey leak)CVE-2026-545096.5 Medium
- mauriceboe trekTREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolutionCVE-2026-545085.3 Medium
- mauriceboe trekTREK: Stored cross-user HTML injection via trip title in the Journey suggestion bannerCVE-2026-545052.0 Low
- mauriceboe trekTime-based user enumeration in TREK authentication endpointCVE-2026-454105.3 Medium
- mauriceboe trekMissing Authorization on Immich Trip Photo Routes in TREKCVE-2026-401857.1 High
- mauriceboe trekUnauthenticated Access to Uploaded Files in TREKCVE-2026-401843.7 Low