PT-2026-81298

CVE-2026-78887

Published

2026-08-25

Updated

2026-08-25

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X

Name of the Vulnerable Software and Affected Versions liketrek TREK versions prior to 3.1.0

Description An issue exists in the Journey Photo Proxy component where the validateShareTokenForAsset() function can be manipulated. This flaw allows a remote attacker to achieve incorrect authorization, although the attack is characterized by high complexity and is difficult to exploit.

Recommendations Upgrade to version 3.1.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Bytejmp

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

CWE-285: Improper Authorization