---
id: CVE-2026-77320
title: TREK is a collaborative travel planner
summary: >-
  TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in
  server/src/services/shareService.ts returns days, assignments, dayNotes, and
  places through GET /api/shared/:token even when the trip owner disables
  share_map. …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
  - CWE-284
  - CWE-602
vendor: mauriceboe
product: TREK
affected:
  - TREK < 3.3.0
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T19:17:16.730'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77320'
references:
  - url: >-
      https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2
    label: security-advisories@github.com
  - url: 'https://github.com/liketrek/TREK/pull/1520'
    label: security-advisories@github.com
  - url: 'https://github.com/liketrek/TREK/releases/tag/v3.3.0'
    label: security-advisories@github.com
  - url: 'https://github.com/liketrek/TREK/security/advisories/GHSA-9hc8-p7gm-p7mx'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T18:49:36.724Z'
---

## Overview

TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the map, but the public JSON response still includes the itinerary and place names, coordinates, addresses, descriptions, notes, and prices. Anyone holding the valid share token can therefore read location and route information that the owner explicitly chose not to share, although the random token remains required and the flaw does not permit modification. This issue is fixed in version 3.3.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.