CVE-2026-40185: TREK Auth Bypass Vulnerability

CVE-2026-40185 Overview

CVE-2026-40185 is a missing authorization vulnerability in TREK, a collaborative travel planner application. Prior to version 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes, allowing authenticated users to potentially access and modify trip photos belonging to other users without proper authorization.

Critical Impact

Authenticated users can bypass authorization controls to access sensitive trip photos and potentially modify content belonging to other users, leading to unauthorized data exposure and integrity violations.

Affected Products

• TREK collaborative travel planner versions prior to 2.7.2

Discovery Timeline

• April 10, 2026 - CVE-2026-40185 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40185

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), which occurs when a software system does not perform an authorization check when an actor attempts to access a resource or perform an action. In the case of TREK, the Immich trip photo management routes failed to verify whether the requesting user had proper permissions to access or modify specific trip photos.

The lack of authorization checks creates a broken access control scenario where authenticated users can access resources that should be restricted to specific trip participants or owners. This represents a horizontal privilege escalation risk, where users can access data belonging to other users at the same privilege level.

Root Cause

The root cause of this vulnerability is the absence of authorization middleware or permission validation logic on the Immich trip photo management routes. When processing requests to these endpoints, the application verified authentication (confirming the user was logged in) but failed to verify authorization (confirming the user had permission to access the specific resource).

This is a common application security flaw where developers implement authentication but overlook the need for granular access control checks at the resource level.

Attack Vector

The vulnerability is exploitable over the network by any authenticated user. An attacker with a valid account on a TREK instance could craft requests to the Immich trip photo management endpoints, referencing trip IDs or photo resources belonging to other users. Without proper authorization checks, the application would process these requests and return the requested data or perform the requested modifications.

The attack requires low complexity to execute and does not require any user interaction. An attacker simply needs to enumerate or guess valid resource identifiers to access unauthorized content. The primary impact is confidentiality breach through unauthorized access to trip photos, with secondary integrity impact through potential modification capabilities.

Detection Methods for CVE-2026-40185

Indicators of Compromise

• Unusual access patterns to trip photo endpoints by users accessing trips they don't own
• API requests to Immich photo management routes with trip or photo IDs not associated with the requesting user
• Elevated volume of photo enumeration requests from individual user accounts

Detection Strategies

• Implement application-level logging to track which users access which trip resources
• Monitor for sequential or bulk requests to trip photo endpoints that may indicate enumeration attempts
• Audit access logs for users viewing or modifying trips outside their normal usage patterns
• Deploy web application firewalls with rules to detect access control bypass attempts

Monitoring Recommendations

• Enable detailed access logging on all Immich trip photo management routes
• Set up alerts for access attempts to resources outside a user's trip membership
• Regularly audit user access patterns against trip membership data
• Monitor for unusual API request volumes that may indicate automated exploitation

How to Mitigate CVE-2026-40185

Immediate Actions Required

• Upgrade TREK to version 2.7.2 or later immediately
• Review access logs to identify potential unauthorized access to trip photos prior to patching
• Audit user accounts for suspicious activity patterns
• Notify affected users if unauthorized access to their trip data is confirmed

Patch Information

The vulnerability is fixed in TREK version 2.7.2. The fix was implemented in commit 16277a3811a00c2983f7486fee83c112986cb179, which adds proper authorization checks to the Immich trip photo management routes. Organizations running TREK should upgrade to this version immediately.

For detailed information about the patch, see the GitHub Security Advisory GHSA-pcr3-6647-jh72 and the v2.7.2 release notes.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the Immich trip photo integration
• Implement network-level access controls to restrict access to the application to trusted users only
• Deploy a reverse proxy or web application firewall with custom rules to enforce authorization on affected routes
• Monitor the affected endpoints closely for suspicious access patterns until patching can be completed

# Example: Verify installed TREK version
docker exec -it trek-app cat /app/package.json | grep version

# Upgrade to patched version
docker pull mauriceboe/trek:2.7.2
docker-compose down && docker-compose up -d