{"apiVersion":"1.0","identifier":"CVE-2026-54509","description":"TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user-s journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey-s entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0.","publishedAt":"2026-08-20T22:17:21","lastModifiedAt":"2026-08-21T15:16:41","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54509","cvssScore":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","epssProbability":0.00304,"riskScore":0.67,"affectedProduct":"TREK","affectedVersions":">=3.0.0,<3.1.0","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-54509","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-54509","en":"https://www.redsauce.net/en/cves/CVE-2026-54509","fr":"https://www.redsauce.net/fr/cves/CVE-2026-54509","pt":"https://www.redsauce.net/pt/cves/CVE-2026-54509","de":"https://www.redsauce.net/de/cves/CVE-2026-54509","sk":"https://www.redsauce.net/sk/cves/CVE-2026-54509","el":"https://www.redsauce.net/el/cves/CVE-2026-54509"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-54509"}}