Wger
CVE-2026-27839
MEDIUM
GHSA-g8gc-6c4h-jg86
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three nutritional_values action endpoints fetch objects via Model.objects.get(pk=pk) - a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e contains a fix for the issue.
AnalysisAI
Wger versions up to 2.4 allow authenticated users to access other users' private nutrition plans through insecure direct object references in the nutritional_values endpoints, exposing sensitive dietary data including caloric intake and macronutrient breakdowns. The vulnerability stems from bypassing user-scoped querysets via direct primary key lookups, and public exploit code is available.
Technical ContextAI
Classified as CWE-639 (Authorization Bypass Through User-Controlled Key). Affects Wger. wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three nutritional_values action endpoints fetch objects via Model.objects.get(pk=pk) — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e contains a fix for the issue.
RemediationAI
A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2. Rated cri
Wger versions up to 2.4 expose all users' repetition configuration data to any authenticated attacker due to missing aut
wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calli
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and
Incomplete authorization fix in wger through master exposes three user-management views in wger/core/views/user.py to th
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's
Open redirect in wger's trainer_login view allows an attacker to redirect an authenticated trainer's browser to an arbit
CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadshe
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today