| शीर्षक | mauriceboe TREK <= 3.0.22 Privilege Escalation |
|---|
| विवरण | IDOR in the journey photo proxy allowing arbitrary asset access in TREK <= 3.0.22. The validateShareTokenForAsset function returns the journey owner's credentials instead of denying access when an asset is not part of the shared journey. An attacker with any valid journey share token can fetch arbitrary photos from the owner's connected photo backend, including private photos never shared in the journey. Exploitation difficulty elevated by 128-bit UUID complexity. CVSS 6.8 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). CWE-863. Fixed in 3.1.0. |
|---|
| स्रोत | ⚠️ https://github.com/mauriceboe/TREK/security/advisories/GHSA-24x9-fcj9-vp6w |
|---|
| उपयोगकर्ता | ByteJMP (UID 99294) |
|---|
| सबमिशन | 12/07/2026 06:43 AM (1 महीना पहले) |
|---|
| संयम | 25/08/2026 08:01 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394943 [liketrek TREK तक 3.0.22 Journey Photo Proxy validateShareTokenForAsset अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|