A missing authorization vulnerability in the TREK travel planner allows authenticated users to access restricted photo management routes, posing a significant risk to data confidentiality.

The application fails to perform proper authorization checks on specific API routes related to Immich trip photo management. An attacker with low-level authenticated access can exploit this flaw to view or manipulate data they are not authorized to access.

The exploitation of this vulnerability could lead to unauthorized access to sensitive travel photos and trip metadata, resulting in a potential breach of user privacy. With a CVSS score of 7.1, this is classified as a High severity issue, as it permits unauthorized information disclosure that could impact user trust and organizational data protection standards.

Immediate Action: Update the TREK application to version 2.7.2 or later to apply the necessary authorization patches.

Proactive Monitoring: Review application access logs for unusual patterns of API requests directed toward photo management endpoints, particularly those originating from accounts with limited privileges.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to filter and monitor traffic to the administrative and photo management API routes until the software is updated.

Public Exploit Available: No.

Given the High severity rating and the potential for unauthorized data access, administrators should prioritize updating to version 2.7.2 immediately. Ensuring that only authorized users have access to sensitive trip management features is critical to maintaining the integrity and privacy of the platform.