{"id":"CVE-2026-62344","kind":"vulnerability","aliases":["CVE-2026-62344"],"related":[],"title":"Wanderer: unauthenticated ActivityPub endpoints leak private trail and comment records","description":"Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to return full trail and comment records without applying the PocketBase collection view rules. An attacker who can enumerate or guess record IDs can retrieve private trail names, descriptions, GPS coordinates, GPX file URLs, photo URLs, and comments. This issue is fixed in version 0.19.3.","summary":"Wanderer, a self-hosted trail database, exposes trail and comment records through unauthenticated ActivityPub endpoints that skip the collection view rules. An attacker who can enumerate or guess record IDs can read private trail names, GPS coordinates, GPX and photo URLs, and comments.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pocketbase","self-hosted","wanderer"],"not_affected_if":["managed-hosting","version-0.19.3-or-later"],"how_to_check":"- Check the Wanderer version in use; affected builds are those before `0.19.3`.\n- Test whether `GET /activitypub/trail/{id}` answers without a login for a trail marked private.","fix":"- Upgrade Wanderer to `0.19.3`.","status":"open","published_at":"2026-11-06T18:18:16+00:00","first_seen_at":"2026-11-06T18:44:09+00:00","triaged_at":"2026-11-06T18:45:13+00:00","updated_at":"2026-11-06T18:45:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T18:45:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Wanderer to `0.19.3`.","reach":"internet","title":"Wanderer: unauthenticated ActivityPub endpoints leak private trail and comment records","impact":"medium","summary":"Wanderer, a self-hosted trail database, exposes trail and comment records through unauthenticated ActivityPub endpoints that skip the collection view rules. An attacker who can enumerate or guess record IDs can read private trail names, GPS coordinates, GPX and photo URLs, and comments.","audience":"businesses","category":"package","nicknames":[],"who_cares":["self-hosted","wanderer","pocketbase"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"private trail data and comments readable without any login","analyst_note":"Confirm the exposed endpoints and the fixed version from the linked Wanderer release notes and vendor advisory on github.com.","how_to_check":"- Check the Wanderer version in use; affected builds are those before `0.19.3`.\n- Test whether `GET /activitypub/trail/{id}` answers without a login for a trail marked private.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","version-0.19.3-or-later"],"who_is_affected":"Teams that self-host Wanderer below version 0.19.3 and expose its web interface to the internet are exposed, since the flaw is reachable without an account. Instances that are not internet-facing, or that run a fixed version, are not affected by this issue.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4350,"output_tokens":567,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62344':13A,16A '/activitypub/comment':90C '/activitypub/trail':86C '0.19.3':82C,141C 'activitypub':3A,37B 'activitypubcom':96C 'activitypubtrail':94C 'adventur':79C 'appli':105C 'attack':46B,112C 'call':93C 'collect':42B,108C 'comment':9A,33B,66B,102C,134C 'coordin':60B,127C 'cve':11A,14A 'databas':29B,74C 'descript':125C 'endpoint':4A,38B,92C 'enumer':49B,115C 'expos':30B 'file':129C 'fix':138C 'full':99C 'get':85C,89C 'gps':59B,126C 'gpx':61B,128C 'guess':51B,117C 'host':21B,27B,72C 'id':53B,87C,91C,119C 'issu':136C 'leak':5A 'name':58B,124C 'packag':17B 'photo':63B,131C 'pocketbas':18B,107C 'prior':80C 'privat':6A,56B,122C 'read':55B 'record':10A,34B,52B,103C,118C 'retriev':121C 'return':98C 'rule':44B,110C 'save':76C 'self':20B,26B,71C 'self-host':19B,25B,70C 'share':78C 'skip':40B 'trail':7A,28B,31B,57B,73C,100C,123C 'unauthent':2A,36B,84C 'url':64B,130C,132C 'version':140C 'view':43B,109C 'wander':1A,22B,23B,67C 'without':104C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Wanderer below version 0.19.3 and expose its web interface to the internet are exposed, since the flaw is reachable without an account. Instances that are not internet-facing, or that run a fixed version, are not affected by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","pocketbase","selfhosted","wanderer"],"campaign_type":null,"search_a":"'-2026':12A,15A '-62344':13A,16A 'activitypub':3A 'comment':9A 'cve':11A,14A 'endpoint':4A 'leak':5A 'privat':6A 'record':10A 'trail':7A 'unauthent':2A 'wander':1A","search_b":"'activitypub':37B 'attack':46B 'collect':42B 'comment':33B,66B 'coordin':60B 'databas':29B 'endpoint':38B 'enumer':49B 'expos':30B 'gps':59B 'gpx':61B 'guess':51B 'host':21B,27B 'id':53B 'name':58B 'packag':17B 'photo':63B 'pocketbas':18B 'privat':56B 'read':55B 'record':34B,52B 'rule':44B 'self':20B,26B 'self-host':19B,25B 'skip':40B 'trail':28B,31B,57B 'unauthent':36B 'url':64B 'view':43B 'wander':22B,23B","search_c":"'/activitypub/comment':90C '/activitypub/trail':86C '0.19.3':82C,141C 'activitypubcom':96C 'activitypubtrail':94C 'adventur':79C 'appli':105C 'attack':112C 'call':93C 'collect':108C 'comment':102C,134C 'coordin':127C 'databas':74C 'descript':125C 'endpoint':92C 'enumer':115C 'file':129C 'fix':138C 'full':99C 'get':85C,89C 'gps':126C 'gpx':128C 'guess':117C 'host':72C 'id':87C,91C,119C 'issu':136C 'name':124C 'photo':131C 'pocketbas':107C 'prior':80C 'privat':122C 'record':103C,118C 'retriev':121C 'return':98C 'rule':110C 'save':76C 'self':71C 'self-host':70C 'share':78C 'trail':73C,100C,123C 'unauthent':84C 'url':130C,132C 'version':140C 'view':109C 'wander':67C 'without':104C","first_public_at":"2026-07-02T13:02:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62344","severity":null,"published_at":"2026-11-06T18:18:16+00:00","modified_at":"2026-11-06T18:18:16+00:00","first_seen_at":"2026-11-06T18:44:09+00:00","fetched_at":"2026-11-06T18:44:09+00:00","note":null}],"documents":[{"id":88847,"url":"https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88848,"url":"https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88849,"url":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-9qg7-jr2x-prvh","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T13:02:15+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}