---
id: "CVE-2026-62344"
page: "https://infrastack.ai/live/CVE-2026-62344"
kind: "vulnerability"
aliases: ["CVE-2026-62344"]
title: "Wanderer: unauthenticated ActivityPub endpoints leak private trail and comment records"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "pocketbase", "self-hosted", "wanderer"]
not_affected_if: ["managed-hosting", "version-0.19.3-or-later"]
published_at: "2026-11-06T18:18:16+00:00"
first_seen_at: "2026-11-06T18:44:09+00:00"
updated_at: "2026-11-06T18:45:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62344", "first_seen_at": "2026-11-06T18:44:09+00:00"}]
exploit_sources: []
---

# Wanderer: unauthenticated ActivityPub endpoints leak private trail and comment records

Link for people: https://infrastack.ai/live/CVE-2026-62344 (this .md is for agents)

Wanderer, a self-hosted trail database, exposes trail and comment records through unauthenticated ActivityPub endpoints that skip the collection view rules. An attacker who can enumerate or guess record IDs can read private trail names, GPS coordinates, GPX and photo URLs, and comments.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Wanderer version in use; affected builds are those before `0.19.3`.
- Test whether `GET /activitypub/trail/{id}` answers without a login for a trail marked private.

## Fix

- Upgrade Wanderer to `0.19.3`.

## Timeline

- 2026-11-06T18:44:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62344

## Documents

- [advisory] Vendor advisory: github.com https://github.com/open-wanderer/wanderer/security/advisories/GHSA-9qg7-jr2x-prvh
- [fix] Patch: github.com https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b
- [fix] Release notes: github.com https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3

## From the sources

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to return full trail and comment records without applying the PocketBase collection view rules. An attacker who can enumerate or guess record IDs can retrieve private trail names, descriptions, GPS coordinates, GPX file URLs, photo URLs, and comments. This issue is fixed in version 0.19.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_