wger is a free, open‑source workout and fitness manager. In all releases prior to 2.6, any authenticated user can read another user’s private workout session notes, exercise history, and training statistics by invoking the /logs/ and /stats/ actions on a routine they do not own. The flaw originates in RoutineViewSet, where the permission check grants read access to any authenticated user when the routine has is_template = True, regardless of ownership. Consequently, a user can retrieve the owner’s private workout history instead of their own. The vulnerability does not compromise system integrity or availability, but it exposes sensitive personal data. The issue has been corrected in version 2.6.

The vulnerability affects the wger-project wger application in all releases earlier than version 2.6. Any installation using those earlier versions exposes the private workout data of users who mark a routine as a template.

The CVSS score of 7.5 indicates moderate to high severity. The EPSS score of less than 1 % suggests exploitation is currently unlikely. The vulnerability is not included in the CISA KEV catalog. Attackers must be authenticated and invoke the /logs/ or /stats/ API endpoints with a routine that is marked as a template and not owned by them. The vulnerability exploits the application’s normal API path and does not require any special privileges beyond authentication.