CVE-2026-78887: liketrek TREK Auth Bypass Vulnerability

CVE-2026-78887 Overview

CVE-2026-78887 is an incorrect authorization vulnerability affecting liketrek TREK versions up to 3.0.22. The flaw resides in the validateShareTokenForAsset function within the Journey Photo Proxy component. Attackers can manipulate the share token validation logic to gain unauthorized access to assets over the network. The vulnerability is classified under CWE-285: Improper Authorization. Exploitation is remote but requires high attack complexity, and no public proof-of-concept exploit is currently available. Upgrading to TREK version 3.1.0 remediates the issue.

Critical Impact
Remote attackers may bypass share token authorization checks in the Journey Photo Proxy, gaining unauthorized read access to journey photo assets served by affected TREK deployments.

Affected Products

liketrek TREK versions up to and including 3.0.22
TREK Journey Photo Proxy component
Fixed in TREK version 3.1.0

Discovery Timeline

2026-08-25 - CVE-2026-78887 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78887

Vulnerability Analysis

The vulnerability affects the validateShareTokenForAsset function inside the Journey Photo Proxy component of TREK. This function is responsible for confirming that a presented share token authorizes access to a specific asset. Improper authorization logic in this validation path allows manipulated requests to receive access decisions that do not match the actual token scope.

The attack is launched remotely across the network without authentication or user interaction. However, exploitation carries high complexity, meaning the attacker must satisfy conditions outside of their direct control such as timing, request shape, or specific token state. Vendor telemetry describes exploitability as difficult. Impact is limited to confidentiality of asset data; integrity and availability are not affected according to the advisory scoring.

Root Cause

The root cause is improper authorization enforcement inside validateShareTokenForAsset. The function does not correctly bind a share token to the requested asset identifier, permitting decisions that grant access to assets outside the token's intended scope. This is a classic [CWE-285] weakness where an authorization check exists but is implemented in a way that can be bypassed through request manipulation.

Attack Vector

An unauthenticated remote attacker crafts HTTP requests against the Journey Photo Proxy endpoint that invokes validateShareTokenForAsset. By manipulating parameters that influence token-to-asset binding, the attacker can cause the function to authorize retrieval of assets the presented token should not cover. No user interaction is required. Technical details are referenced in the GitHub Security Advisory GHSA-24x9-fcj9-vp6w and the VulDB entry for CVE-2026-78887.

No verified proof-of-concept code is publicly available. See the vendor advisory for technical details.

Detection Methods for CVE-2026-78887

Indicators of Compromise

Repeated HTTP requests to Journey Photo Proxy endpoints with varying assetId or share token parameters from a single source
Access to journey photo assets by clients presenting share tokens issued for different assets
Anomalous 200-OK responses on asset retrieval paths from unauthenticated or low-reputation sources

Detection Strategies

Enable application-level logging for all invocations of validateShareTokenForAsset including token identifier, requested asset identifier, and authorization outcome
Alert on mismatches between the asset scope encoded in a share token and the asset actually returned
Baseline normal share-token usage patterns and flag deviations such as high fan-out of a single token across many asset IDs

Monitoring Recommendations

Forward TREK application and proxy logs to a centralized SIEM for correlation across sessions and source IPs
Monitor egress volume from the Journey Photo Proxy for unexpected spikes indicating bulk asset enumeration
Track versions of TREK deployed across the environment and alert on any instance still running 3.0.22 or earlier

How to Mitigate CVE-2026-78887

Immediate Actions Required

Upgrade TREK to version 3.1.0 or later using the official v3.1.0 release
Inventory all internal and external TREK deployments and prioritize internet-facing instances for patching
Rotate active share tokens after upgrading so that any tokens issued under the vulnerable logic are invalidated

Patch Information

The vendor released TREK 3.1.0 to remediate CVE-2026-78887. Details of the fix and download artifacts are documented in the GitHub release notes for v3.1.0 and the GHSA-24x9-fcj9-vp6w advisory. Applying the upgrade replaces the flawed authorization logic in validateShareTokenForAsset.

Workarounds

Restrict network exposure of the Journey Photo Proxy to trusted networks or authenticated reverse proxies until the upgrade is applied
Disable or shorten the lifetime of share tokens for sensitive journeys to reduce the window for abuse
Deploy a web application firewall rule that rejects Journey Photo Proxy requests containing anomalous or malformed share token parameters

bash

# Example: verify the running TREK version and pull the fixed release
git -C /opt/trek describe --tags
git -C /opt/trek fetch --tags
git -C /opt/trek checkout v3.1.0