Vulnerabilities

Security incident · CVE-2026-46438

wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

Published Oct 7, 2026 · catalog updated Oct 26, 2026 · wger: Cross-User Data Corruption

Last checked Oct 27, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-46438. EPSS is 0.23%. Act only if a listed version of wger: Cross-User Data Corruption is installed.

Severity

Medium6.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.23%

Remediation

Advisory link

Affected products

PyPI wger

### Summary An authenticated attacker can inject arbitrary workout log entries into any other user's by supplying the victim's ID in a request. The foreign key is not included in the ownership verification performed by , so the server accepts and persists the cross-user reference without error. Because retrieves associated logs via with **no user filter**, the attacker's injected data is silently folded into the victim's progressive-overload calculations, corrupting their auto-generated weight and repetition targets. ### Details wger uses a centralized ownership-verification pattern in (file: ). This method iterates over the list returned by each ViewSet's and verifies that every listed foreign-key value in the request belongs to the authenticated user. **Foreign keys not present in the list are never checked.** returns: Because is omitted, an attacker can supply their own (which passes the ownership check) alongside a victim's ID (which is never verified). The second contributing factor is in : This reverse-relation query returns **all** rows linked to the , regardless of which user created them. The attacker's injected entries are therefore included in the victim's progression calculations. ### PoC #### Prerequisites - Two authenticated user accounts (attacker and victim) - The attacker knows (or can enumerate) the victim's ID - The attacker has at least one of their own (to satisfy the ownership check) #### Attack Steps **Expected:** HTTP 403 (the belongs to another user) **Actual:** HTTP 201 (the log is created and linked to the victim's ) #### Proof of Concept Script #### Proof of Concept Output ### Impact 1. **Training Data Integrity:** The progressive-overload engine ( ) uses injected fake values when computing the victim's next workout targets. An attacker setting or can produce dangerous or nonsensical training recommendations. 2. **Silent Corruption:** The victim receives no notification. Their training plan simply starts producing unexpected numbers. 3. *