CVE-2026-40185
Published: 10 April 2026
Summary
CVE-2026-40185 is a high-severity Missing Authorization (CWE-862) vulnerability in Mauriceboe Trek. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-40185 affects TREK, an open-source collaborative travel planner, in versions prior to 2.7.2. The vulnerability stems from missing authorization checks on the Immich trip photo management routes, classified under CWE-862 (Missing Authorization). It has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability impact.
An attacker with low privileges, such as an authenticated user, can exploit this over the network with low complexity and no user interaction required. By accessing the vulnerable Immich trip photo management routes without proper authorization, they can achieve high-level unauthorized access to confidential trip photo data and limited integrity modifications.
The GitHub security advisory (GHSA-pcr3-6647-jh72) and release notes for TREK v2.7.2 detail the fix via commit 16277a3811a00c2983f7486fee83c112986cb179, which implements the necessary authorization checks on the affected routes. Security practitioners should upgrade to TREK 2.7.2 or later to mitigate this issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21587
Vulnerability details
TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization on web routes of a network-exposed collaborative application directly enables exploitation of public-facing apps for unauthorized data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 requires systems to enforce approved authorizations for access to resources, directly mitigating the missing authorization checks on Immich trip photo management routes.
AC-6 enforces least privilege, limiting the scope of access for low-privileged authenticated users and reducing the impact of authorization bypasses to confidential trip photo data.
SI-2 mandates timely identification, reporting, and correction of system flaws, directly addressing this vulnerability through upgrades to TREK 2.7.2 or later implementing the fix.