CVE-2026-40185

CVE-2026-40185 affects TREK, a collaborative travel planning application, in versions prior to 2.7.2. The vulnerability stems from missing authorization checks on Immich trip photo management routes, allowing authenticated users to access or view trip photos without proper access controls. This flaw has been remediated in version 2.7.2. The vulnerability presents moderate risk with a CVSS score of 6.5, exploitable over the network by authenticated users with low complexity and no user interaction required. The primary impact is confidentiality breach through unauthorized disclosure of trip photo data, with no impact on system integrity or availability. The low EPSS score of 0.00031 indicates minimal exploitation likelihood relative to other published vulnerabilities. There is currently no active exploitation of this vulnerability in the wild, no public exploit code availability, and limited community attention as evidenced by its inactive status on security tracking lists and absence from the Known Exploited Vulnerabilities catalog. Organizations running TREK should prioritize patching to version 2.7.2 to prevent unauthorized photo access by authenticated users.