CVE-2026-40185 HIGH

CVE-2026-40185: Missing Authorization on Immich Trip Photo Routes in TREK

Vendor Mauriceboe

Product TREK

Weakness CWE-862 · Missing authorization

Published April 10, 2026

Last update April 15, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2.

Key dates

02Disclosure timeline

April 10, 2026 CVE published

April 15, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-40185 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html