Platform
nodejs
Component
trek-travel-planner
Fixed in
2.7.3
CVE-2026-40185 describes an authorization bypass vulnerability discovered in TREK Travel Planner. This flaw allows attackers to access trip photo management routes without proper authentication, potentially leading to unauthorized data exposure. The vulnerability affects versions 1.0.0 through 2.7.2 and has been resolved in version 2.7.2.
An attacker exploiting this authorization bypass can gain unauthorized access to trip photo management routes within the TREK Travel Planner application. This could allow them to view, modify, or delete sensitive travel-related photos and associated metadata. The potential impact includes exposure of personal travel itineraries, private photos, and potentially other sensitive information stored within the application. While the scope is limited to the photo management functionality, successful exploitation could compromise the privacy and security of users' travel plans.
CVE-2026-40185 was publicly disclosed on 2026-04-10. Currently, there are no known public proof-of-concept exploits available. The EPSS score is pending evaluation. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.03% (8% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-40185 is to immediately upgrade TREK Travel Planner to version 2.7.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the photo management routes through a Web Application Firewall (WAF) or proxy server. Configure the WAF to block requests to these routes from unauthorized users or IP addresses. After upgrading, confirm the fix by attempting to access the photo management routes without proper authentication; access should be denied.
Update TREK to version 2.7.2 or higher to mitigate the authorization vulnerability. This update implements the necessary authorization checks in the Immich trip photo management routes, preventing unauthorized access to data.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-40185 is a HIGH severity vulnerability in TREK Travel Planner versions 1.0.0 through 2.7.2 that allows unauthorized access to trip photo management routes.
Yes, if you are using TREK Travel Planner versions 1.0.0 through 2.7.2, you are affected by this vulnerability.
Upgrade TREK Travel Planner to version 2.7.2 or later to resolve this authorization bypass vulnerability.
Currently, there are no known active exploits for CVE-2026-40185, but it is crucial to apply the patch promptly.
Refer to the TREK Travel Planner project's official communication channels and release notes for the advisory regarding CVE-2026-40185.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.