CVE-2026-40185CWE-862

Missing Authorization on Immich Trip Photo Routes in TREK

High · published April 10, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
28.2
In the wild
Unconfirmed
What it is

TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00357 · 28.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-04-10T19:40Z
EPSS history
Timeline
  • 10 APR 19:40Z
    Missing Authorization on Immich Trip Photo Routes in TREK
    cvelistv5