wger is an open-source fitness manager that stores workout logs in a relational database. The flaw allows an authenticated user to insert a workout entry that references another user's SlotEntry by posting a malicious payload to the /api/v2/workoutlog/ endpoint. Because the server does not check that the supplied slot_entry belongs to the requester, it accepts and persists the foreign key. The victim’s progressive‑overload logic then incorporates the injected data, altering weight and repetition targets and corrupting the user’s session data.

All wger installations running a version older than 2.6 are vulnerable. Any deployment of the wger workout management platform that has not applied the 2.6 release or later is susceptible to this data integrity issue.

The CVSS score of 6.5 represents moderate severity. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available. An attacker must be authenticated and must know the victim’s SlotEntry ID to exploit the flaw; consequently, the threat is most relevant to insider or compromised accounts. The missing ownership check is the root weakness, identified by CWE‑639 and CWE‑862.