The vulnerability is an IDOR (CWE‑639) in the nutritional_values endpoints of the wger open‑source fitness manager. Three API routes use a direct ORM lookup via Model.objects.get(pk=pk), ignoring the user‑scoped queryset. An authenticated user can supply any primary key and read another user’s private nutrition plan, including caloric intake and macro breakdown, thereby disclosing personally sensitive health data. The flaw does not provide privilege escalation, denial of service, or remote code execution; its main consequence is confidentiality loss.

The issue affects the wger project’s wger application in all releases up to and including version 2.4. The vulnerable code resides in the nutritional_values endpoints. The code was fixed in commit 29876a1954fe959e4b58ef070170e81703dab60e, which should be applied to releases beyond 2.4.

The CVSS base score is 4.3, indicating a moderate severity, while the EPSS score is less than 1%, suggesting a low likelihood of exploitation at present. The flaw is not listed in KEV, implying no known active use in the wild. Exploitation requires an authenticated user who can send requests with arbitrary primary keys to the endpoints; no special privileges beyond authentication are needed. An attacker could extract sensitive personal health information, potentially impacting privacy and personal security.