Description

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to return full trail and comment records without applying the PocketBase collection view rules. An attacker who can enumerate or guess record IDs can retrieve private trail names, descriptions, GPS coordinates, GPX file URLs, photo URLs, and comments. This issue is fixed in version 0.19.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T18:18:16.933Z",
  "pubdate": "2026-11-06T18:18:16.933Z",
  "executiveSummary": "The self-hosted trail database application 'Wanderer' contains an improper access control vulnerability within its ActivityPub integration endpoints, specifically affecting versions prior to 0.19.3.\nThis vulnerability stems from a failure to enforce PocketBase collection view rules when processing unauthenticated requests to the /activitypub/trail/{id} and /activitypub/comment/{id} endpoints.\nThe flaw allows unauthorized remote attackers to bypass intended data access restrictions by directly querying record IDs.\nThe impact is significant, as it enables the unauthorized disclosure of sensitive data including private trail names, descriptions, geographical coordinates, GPX file locations, photo URLs, and comment contents.\nBecause the application does not require authentication to access these endpoints, the barrier to exploitation is low for an attacker capable of record ID enumeration or guessing.\nOrganizations deploying Wanderer are at high risk of data breaches involving private user activity and location tracking information until the software is updated.",
  "technicalDetails": "The vulnerability resides in the core handling logic for the ActivityPub API endpoints in Wanderer, specifically the GET /activitypub/trail/{id} and GET /activitypub/comment/{id} routes.\nThe root cause is an insecure implementation within the ActivitypubTrail() and ActivitypubComment() functions. These functions perform direct record retrieval from the underlying PocketBase database without invoking or respecting the defined PocketBase collection view rules, which are intended to govern data accessibility based on user privileges and sharing settings.\nIn a secure configuration, PocketBase collection rules should filter results so that only authorized users or public-facing records are returned. By bypassing these security filters, the functions return full data objects regardless of the record's 'private' status.\nThe attack flow involves an attacker sending crafted HTTP GET requests to the identified endpoints. Since the endpoint does not validate if the requester has the necessary permissions to access the specific ID, the application retrieves the record from the database and returns it in the JSON response body.\nAn attacker can exploit this by iterating through predictable or guessable identifiers (UUIDs or incrementing IDs) to scrape private records from the database. This does not require an authenticated session or specialized privileges, as the vulnerable functions effectively ignore the security context of the incoming request.\nExposure is global, as the endpoints are reachable via standard HTTP protocols from any network location where the Wanderer instance is exposed. The resulting data leakage includes sensitive geolocation metadata and user-generated content that was never intended for public view.\nThe vulnerability is explicitly present in all versions prior to 0.19.3. Once the database records are successfully retrieved, an attacker can extract sensitive metadata, such as GPS coordinates and private GPX file URLs, allowing for the mapping of user movements and the acquisition of private multimedia assets."
}