PT-2026-41136 · Wger · Wger
CVE-2026-43977
·
Published
2026-05-14
·
Updated
2026-07-16
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
wger versions prior to 2.5.0a2
Description
An insecure direct object reference (IDOR) allows any authenticated user to access the private health data of other users. The issue occurs when a user has a routine marked as a public template, which triggers a permission check in the
RoutinePermission class that grants read access to any authenticated user. While templates are intended to be public workout plans, the /logs/ and /stats/ API endpoints return the routine owner's personal training history instead of the requesting user's data.An attacker can enumerate public template IDs via the
/api/v2/routine/ endpoint and then call the following endpoints to retrieve private workout session notes, exercise history (including weights and repetitions), and performance statistics:/api/v2/routine/{id}/logs//api/v2/routine/{id}/stats/
The vulnerability is located in the
RoutineViewSet within wger/manager/api/views.py and the has object permission() function in wger/manager/api/permissions.py.Recommendations
Update wger to a version later than 2.5.0a2.
As a temporary mitigation, restrict access to the
/logs/ and /stats/ API endpoints to ensure they only return data for the requesting user and deny access to these actions for non-owners regardless of the is template status.Exploit
Fix
Improper Access Control
Incorrect Authorization
Information Disclosure
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Wger