Unauthenticated GET requests to the /activitypub/trail/{id} and /activitypub/comment/{id} endpoints expose complete private records, including names, descriptions, GPS coordinates, GPX file URLs, photo URLs, and comments. The flaw arises from a missing enforcement of PocketBase collection view rules, allowing any requester who can guess or enumerate record identifiers to retrieve sensitive data. This constitutes an indirect information exposure, rated as CWE-639, and can compromise user privacy and location data.

The vulnerability affects the open‑wanderer Wanderer self‑hosted trail database. All installations running versions earlier than 0.19.3 are impacted; the fix was introduced in release v0.19.3. No other products or vendors are listed as affected.

The CVSS score of 7.5 indicates a high severity for unauthorized disclosure of private data. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed yet. An attacker only needs the ability to guess or enumerate record IDs and can do so over the public network via GET requests; no authentication or additional privileges are required. The resulting impact is limited to information leakage, but the privacy consequences can be substantial for users sharing sensitive trail data.