Read the docs
TI-2026-86052 Aliases CVE-2026-62344

Wanderer ActivityPub endpoints expose private trails and comments

Priority LOW 33CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Wanderer, a self-hosted trail database, is affected before 0.19.3. Its unauthenticated ActivityPub trail and comment endpoints return full records without applying the collection view rules, an authorization bypass through a user-controlled key (CWE-639). A remote attacker who can enumerate or guess record IDs can retrieve private trail details and comments.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to return full trail and comment records without applying the PocketBase collection view rules. An attacker who can enumerate or guess record IDs can retrieve private trail names, descriptions, GPS coordinates, GPX file URLs, photo URLs, and comments. This issue is fixed in version 0.19.3.

Why it matters now

EPSS 0.00277 20th percentileScored 2026-11-07
Fix Fixed wanderer (open-wanderer): 0.19.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-wandererwandererbefore 0.19.30.19.3Patch availableCNA
  • wanderer Vendoropen-wanderer Affected before 0.19.3 Fixed in 0.19.3 Patch available CNA

Remediation

Update Wanderer to version 0.19.3, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA wanderer (open-wanderer) Fixed in 0.19.3

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-62344
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-86059 Server-side request forgery in Wanderer trail download endpoint CVSS 3.1CRITICAL 10.0
  • TI-2026-86058 Stored XSS in Wanderer elevation profile via waypoint name and icon CVSS 3.1HIGH 7.6
  • TI-2026-86057 Stored XSS via waypoint icon in Wanderer map markers CVSS 3.1HIGH 7.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences