CVE-2026-77321

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.3.0

Description The get trip summary() function in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring the trips:read scope. This allows a token granted only unrelated capabilities, such as weather:read, to retrieve core trip summary data, including trip metadata, itinerary days, accommodations, and member email addresses from server/src/services/tripService.ts for every trip accessible to the user. While cross-user trip authorization is still enforced, the lack of a scope check bypasses the least-privilege boundary, exposing trip content and third-party contact information to unauthorized MCP clients.

Recommendations Update to version 3.3.0. As a temporary workaround, restrict the use of the get trip summary() function until the update is applied.