Advisories · Technology
mauriceboe TREK.
Every CVE that names mauriceboe TREK among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
TREK: Cross-user note-file deletion (IDOR / Broken Access Control)
- mauriceboe TREK
- Broken access control
- CVSS 5.3 Medium
TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)
- mauriceboe TREK
- Information disclosure
- Broken access control
- CVSS 4.3 Medium
TREK MCP trip summary bypasses delegated OAuth read scopes
- mauriceboe TREK
- Information disclosure
- Broken access control
- CVSS 8.1 High
TREK: Server-Side Request Forgery via User-Configurable LLM Base URL
- mauriceboe TREK
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
TREK: Cross-trip reservation title disclosure via file links
- mauriceboe TREK
- Broken access control
- CVSS 6.5 Medium
TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)
- mauriceboe TREK
- Broken access control
- CVSS 5.3 Medium
TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution
- mauriceboe TREK
- Server-side request forgery (SSRF)
- CVSS 2.0 Low
TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner
- mauriceboe TREK
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Time-based user enumeration in TREK authentication endpoint
- mauriceboe TREK
- Information disclosure
- CWE-208
- CVSS 7.1 High
Missing Authorization on Immich Trip Photo Routes in TREK
- mauriceboe TREK
- Broken access control
- CVSS 3.7 Low
Unauthenticated Access to Uploaded Files in TREK
- mauriceboe TREK
- Authentication bypass