CVE-2026-62344 · Package
NO FIX YET · SEE WHAT TO DO
Wanderer, a self-hosted trail database, exposes trail and comment records through unauthenticated ActivityPub endpoints that skip the collection view rules. An attacker who can enumerate or guess record IDs can read private trail names, GPS coordinates, GPX and photo URLs, and comments.
first public Jul 2, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Wanderer below version 0.19.3 and expose its web interface to the internet are exposed, since the flaw is reachable without an account. Instances that are not internet-facing, or that run a fixed version, are not affected by this issue.
Not affected if managed-hosting, version-0.19.3-or-later
Who cares pocketbase, self-hosted, wanderer
0.19.3.GET /activitypub/trail/{id} answers without a login for a trail marked private.0.19.3.Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to return full trail and comment records without applying the PocketBase collection view rules. An attacker who can enumerate or guess record IDs can retrieve private trail names, descriptions, GPS coordinates, GPX file URLs, photo URLs, and comments. This issue is fixed in version 0.19.3.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.