Vulnerabilities

Security research · CVE-2026-43977

wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API

Published May 14, 2026 · catalog updated Nov 6, 2026 · wger Vulnerable to IDOR:

Last checked Nov 9, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-43977. EPSS is 0.29%. Act only if a listed version of wger Vulnerable to IDOR: is installed.

Severity

High7.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.29%

Remediation

Advisory link

Affected products

PyPI wger

### Summary Any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The RoutinePermission class grants read access to any authenticated user when a routine has is_template=True, regardless of ownership. The /logs/ and /stats/ API actions use the same permission check but return the routine owner's personal training data instead of the requesting user's data, creating an insecure direct object reference (IDOR). An attacker with a free account can enumerate all public template routine IDs via GET /api/v2/routine/?is_template=true, then call GET /api/v2/routine/{id}/logs/ and GET /api/v2/routine/{id}/stats/ to access the owner's private health data including workout notes, weights, repetitions, and performance statistics. ### Description wger exposes a REST API endpoint that allows any authenticated user to retrieve the **private workout session notes, exercise logs, and training statistics** belonging to another user, as long as that user has at least one routine marked as a public template. The vulnerability exists in ( ). The view defines two custom actions and that are intended to return data for the **requesting user's own** training history within a routine. However, the underlying permission check ( ) grants read access to **any** authenticated user when the routine has , regardless of ownership. When the or actions are invoked against a routine the attacker does not own, they return the **owner's** private workout history, not the attacker's. ### Root Cause **File:** , lines 30–41 **File:** , lines 173–199 retrieves the routine belonging to the **owner** (e.g., user A). Since passes the permission check for any authenticated user, the attacker's request reaches and , which return the **owner's** workout history, not the attacker's. The intended behavior is that templates are public workout *plans* (exercise structure, sets, rep