wger is a free, open-source workout and fitness manager.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 26, 2026 · NIST NVD

   Detected

   wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling . In versions up to and including 2.4, ache keys are scoped only by — no user ID is included. When a victim has previously accessed their routine via the API, an attacker can retrieve the cached response for the same PK without any ownership check. Commit e964328784e2ee2830a19

2. Jun 17, 2026 · NIST NVD

   Updated

   wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling . In versions up to and including 2.4, ache keys are scoped only by — no user ID is included. When a victim has previously accessed their routine via the API, an attacker can retrieve the cached response for the same PK without any ownership check. Commit e964328784e2ee2830a19

Affected

• cpe wger/wgerversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-27838

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-27838

  wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling . In versions up to and including 2.4, ache keys are scoped only by — no user ID is included. When a victim has previously accessed t

  nvd.nist.gov

References

• Patch · github.com
• Exploit · github.com