PT-2026-32037 · Trek+1 · Trek+1

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-40185

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions TREK versions prior to 2.7.2

Description TREK, a collaborative travel planner, lacked authorization checks on the Immich trip photo management routes in versions prior to 2.7.2. This could allow unauthorized access to trip photos.

Recommendations Update to version 2.7.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-40185

Affected Products

Immich

Trek

References · 6

• https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179 · Patch
• https://github.com/mauriceboe/TREK/security/advisories/GHSA-pcr3-6647-jh72 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40185 · Security Note
• https://github.com/mauriceboe/TREK/releases/tag/v2.7.2 · Note
• https://twitter.com/VulmonFeeds/status/2042710290656018866 · Twitter Post
• https://twitter.com/CVEnew/status/2042710177577664645 · Twitter Post