CVE-2026-27839
wger is a free, open-source workout and fitness manager.
Published Feb 26, 2026 · updated Jun 17, 2026 · wger wger
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three action endpoints fetch objects via — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e contains a fix for the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 26, 2026 · NIST NVD
Detected
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three action endpoints fetch objects via — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e con
Jun 17, 2026 · NIST NVD
Updated
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three action endpoints fetch objects via — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e con
Affected
- cpe wger/wgerversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-27839
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-27839
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three action endpoints fetch objects via — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another
nvd.nist.gov