CVE-2026-62344

Name of the Vulnerable Software and Affected Versions Wanderer versions prior to 0.19.3

Description The software fails to apply PocketBase collection view rules when processing requests. An unauthenticated attacker can retrieve private trail names, descriptions, GPS coordinates, GPX file URLs, photo URLs, and comments by enumerating or guessing record IDs. This occurs via the endpoints "/activitypub/trail/{id}" and "/activitypub/comment/{id}", which call the functions ActivitypubTrail() and ActivitypubComment() respectively.

Recommendations Update to version 0.19.3.