Mauriceboe vulnerabilities
We track 2 vulnerabilities in Mauriceboe products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 24, 2026.
2vulnerabilities
0critical
2high
0exploited
7.6average CVSS score
Latest Mauriceboe vulnerabilities
- 8.1 High severity
TREK: Server-Side Request Forgery
TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llm_base_url through the settings API when the LLM_PARSING feature is enabled. Write permission to the target trip instance is required to
- 7.1 High severity
TREK: Authorization Bypass Through User-Controlled Key
TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts