EUVD-2026-118394

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/id and GET /activitypub/comment/id endpoints call ActivitypubTrail and ActivitypubComment to return full trail and comment records without applying the PocketBas...

CVE-2026-62344

Wanderer , a self-hosted trail database, is vulnerable to an authorization bypass in versions prior to 0.19.3 . The unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() respectively, which return full records with...