wger is a free, open-source workout and fitness manager.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 26, 2026 · NIST NVD

   Detected

   wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, and return all users' repetition config data because their calls instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure. Commit 1fda5690b35706bb137850c8a084ec6a13317b64 contains a fix for the issue.

2. Jun 17, 2026 · NIST NVD

   Updated

   wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, and return all users' repetition config data because their calls instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure. Commit 1fda5690b35706bb137850c8a084ec6a13317b64 contains a fix for the issue.

Affected

• cpe wger/wgerversion unspecified

Sources

• NIST NVDVulnerability recordCVE-2026-27835

  wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, and return all users' repetition config data because their calls instead of filtering by the authentica

  nvd.nist.gov

References

• Patch · github.com
• Exploit · github.com