{"schema":"threatline.record/2","record":{"id":"CVE-2026-77321","aliases":["GHSA-qvw8-w937-vcmq"],"summary":"TREK MCP trip summary bypasses delegated OAuth read scopes","details":"TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. A token granted only an unrelated capability, such as weather:read, can receive trip metadata, member email addresses from server/src/services/tripService.ts, itinerary days, and accommodations for every trip accessible to the token's user. Cross-user trip authorization remains enforced, but the missing scope check defeats the consented least-privilege boundary and exposes trip content and third-party contact information to an MCP client that was not authorized to read it. This issue is fixed in version 3.3.0.","categories":["Unclassified"],"product":"TREK","vendor":"mauriceboe","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77321","source_modified_at":"2026-10-05T15:32:36.028Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"TREK","vendor":"mauriceboe","versions":[{"version":"< 3.3.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00199,"percentile":0.09259,"score_date":"2026-10-23"},"published_at":"2026-09-24T18:04:05.947Z","modified_at":"2026-10-05T15:32:36.028Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-77321","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-05T15:32:36.028Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77321","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/liketrek/TREK/security/advisories/GHSA-qvw8-w937-vcmq","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/liketrek/TREK/pull/1520","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/liketrek/TREK/releases/tag/v3.3.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-05T14:47:04.222887Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T15:32:36.028Z","content_hash":"395f30328202fa250e0dddd76199ec98c4b1123e43f3bbf54481c267589711dd"}}