Description (CNA)
A vulnerability was identified in liketrek TREK up to 3.0.22. The impacted element is the function findOrCreateUser of the file server/src/services/oidcService.ts of the component OIDC Service. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. Upgrading to version 3.1.0 is sufficient to resolve this issue. Upgrading the affected component is advised.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| liketrek / TREK | affected 3.0.0; affected 3.0.1; affected 3.0.2; affected 3.0.3; affected 3.0.4; affected 3.0.5; affected 3.0.6; affected 3.0.7; affected 3.0.8; affected 3.0.9; affected 3.0.10; affected 3.0.11; affected 3.0.12; affected 3.0.13; affected 3.0.14; affected 3.0.15; affected 3.0.16; affected 3.0.17; affected 3.0.18; affected 3.0.19; affected 3.0.20; affected 3.0.21; affected 3.0.22; unaffected 3.1.0 |
CWE
CWE-287
References
- https://vuldb.com/vuln/394941
- https://vuldb.com/vuln/394941/cti
- https://vuldb.com/cve/CVE-2026-78885
- https://vuldb.com/submit/886931
- https://github.com/mauriceboe/TREK/security/advisories/GHSA-fvgw-r58q-4cw4
- https://github.com/liketrek/TREK/releases/tag/v3.1.0
ADP enrichment
No English description supplied.
No references supplied.