CVE-2026-78887

Summary

A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. Upgrading to version 3.1.0 will fix this issue. You should upgrade the affected component.

Affected Software

VendorProductVersion RangeStatus
liketrekTREK3.0.0affected
liketrekTREK3.0.1affected
liketrekTREK3.0.2affected
liketrekTREK3.0.3affected
liketrekTREK3.0.4affected
liketrekTREK3.0.5affected
liketrekTREK3.0.6affected
liketrekTREK3.0.7affected
liketrekTREK3.0.8affected
liketrekTREK3.0.9affected
liketrekTREK3.0.10affected
liketrekTREK3.0.11affected
liketrekTREK3.0.12affected
liketrekTREK3.0.13affected
liketrekTREK3.0.14affected
liketrekTREK3.0.15affected
liketrekTREK3.0.16affected
liketrekTREK3.0.17affected
liketrekTREK3.0.18affected
liketrekTREK3.0.19affected
liketrekTREK3.0.20affected
liketrekTREK3.0.21affected
liketrekTREK3.0.22affected
liketrekTREK3.1.0unaffected

Weaknesses

  • CWE-863: Incorrect Authorization
  • CWE-285: Improper Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References