PT-2026-32037 · Trek+1 · Trek+1

CVE-2026-40185 · Published 2026-04-10 · Updated 2026-04-10

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions TREK versions prior to 2.7.2

Description TREK, a collaborative travel planner, lacked authorization checks on the Immich trip photo management routes in versions prior to 2.7.2. This could allow unauthorized access to trip photos.

Recommendations Update to version 2.7.2 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-40185

GHSA-PCR3-6647-JH72

Affected Products

Immich

Trek

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40185.json · Exploit
• https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179 · Patch
• https://github.com/mauriceboe/TREK/security/advisories/GHSA-pcr3-6647-jh72 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40185 · Security Note
• https://osv.dev/vulnerability/CVE-2026-40185 · Vendor Advisory
• https://github.com/mauriceboe/TREK/releases/tag/v2.7.2 · Note
• https://twitter.com/VulmonFeeds/status/2042710290656018866 · Twitter Post
• https://twitter.com/CVEnew/status/2042710177577664645 · Twitter Post