CVE-2026-77293

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.3.0

Description An authorization flaw exists in the collaborative travel planner where the endpoint "DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId" fails to verify if the file belongs to the specified trip. While the system authorizes the user against the tripId, the deleteNoteFile() function in server/src/services/collabService.ts resolves the target using only the noteId and fileId. Consequently, a user with edit permissions on any trip can provide identifiers belonging to another user's trip to permanently delete note-file attachments. The use of sequential identifiers facilitates broad targeting. Read operations for attachments are not affected as they remain trip-scoped.

Recommendations Update to version 3.3.0.