Description
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` return all users' repetition config data because their `get_queryset()` calls `.all()` instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure. Commit 1fda5690b35706bb137850c8a084ec6a13317b64 contains a fix for the issue.
Published: 2026-02-26
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information disclosure via an IDOR that allows an authenticated user to view other users' workout configuration data
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an Insecure Direct Object Reference in two API endpoints that manage repetition configuration data. The viewsets inadvertently return all users’ data instead of filtering to the authenticated account, enabling privacy violations with no code execution or privilege escalation. This issue is classified under CWE‑639.

Affected Systems

The affected product is the open‑source wger workout manager, versions up to and including 2.4. Any installation of the 2.4 branch or prior versions that had not been patched with commit 1fda5690b35706bb137850c8a084ec6a13317b64 is susceptible.

Risk and Exploitability

The CVSS score of 4.3 reflects a medium confidentiality impact, while an EPSS score of less than 1 % indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs a legitimate user account and can trigger the flaw by making a normal API request to the vulnerable endpoints; no special conditions are required.

Generated by OpenCVE AI on April 17, 2026 at 14:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade wger to the latest release that includes commit 1fda5690b35706bb137850c8a084ec6a13317b64, which applies the necessary filtering to the querysets.
  • Configure application logic to verify that the authenticated user’s ID matches the owner of each repetition configuration before sending it in responses, ensuring cross-user data cannot be retrieved even if the database query is misconfigured.
  • Temporarily restrict or rate‑limit anonymous API access until the application is fully secured to reduce the attack surface.

Generated by OpenCVE AI on April 17, 2026 at 14:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-xf68-8hjw-7mpm wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
History

Tue, 03 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Wger
Wger wger
CPEs cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:*
Vendors & Products Wger
Wger wger

Tue, 03 Mar 2026 06:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 27 Feb 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Wger-project
Wger-project wger
Vendors & Products Wger-project
Wger-project wger

Thu, 26 Feb 2026 22:15:00 +0000

Type Values Removed Values Added
Description wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` return all users' repetition config data because their `get_queryset()` calls `.all()` instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure. Commit 1fda5690b35706bb137850c8a084ec6a13317b64 contains a fix for the issue.
Title wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Wger Wger
Wger-project Wger
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-03T01:38:18.118Z

Reserved: 2026-02-24T02:32:39.800Z

Link: CVE-2026-27835

cve-icon Vulnrichment

Updated: 2026-03-03T01:38:13.735Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-26T22:20:49.333

Modified: 2026-03-03T20:01:10.130

Link: CVE-2026-27835

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T14:15:21Z

Weaknesses