{"id":"CVE-2026-77321","revision":"894c56e6fc41490c8ac1806c7aa09212","records":[{"revision":"894c56e6fc41490c8ac1806c7aa09212","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-77321","aliases":[],"title":"TREK MCP trip summary bypasses delegated OAuth read scopes","description":"TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. A token granted only an unrelated capability, such as weather:read, can receive trip metadata, member email addresses from server/src/services/tripService.ts, itinerary days, and accommodations for every trip accessible to the token's user. Cross-user trip authorization remains enforced, but the missing scope check defeats the consented least-privilege boundary and exposes trip content and third-party contact information to an MCP client that was not authorized to read it. This issue is fixed in version 3.3.0.","state":0,"publishedAt":"2026-09-24T18:04:05.947+00:00","modifiedAt":"2026-10-05T15:32:36.028+00:00","affected":[{"ecosystem":"Vendor product","name":"TREK","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"mauriceboe\",\n                    \"product\": \"TREK\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.3.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/liketrek/TREK/security/advisories/GHSA-qvw8-w937-vcmq","https://github.com/liketrek/TREK/pull/1520","https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2","https://github.com/liketrek/TREK/releases/tag/v3.3.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-77321","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-77321","identifiers":["CVE-2026-77321"]},"retained":false,"historicalAffected":[]}],"coverage":[]}