CVE-2026-27835 Details
Description
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` return all users' repetition config data because their `get_queryset()` calls `.all()` instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure. Commit 1fda5690b35706bb137850c8a084ec6a13317b64 contains a fix for the issue.
A broken object-level authorization vulnerability has been identified in the wger workout and fitness manager, specifically in versions through 2.4. The issue arises in the RepetitionsConfigViewSet and MaxRepetitionsConfigViewSet, where the get_queryset() method retrieves all users' repetition configuration data without filtering for the authenticated user. This oversight allows any registered user to access and enumerate the workout structures of all other users. The vulnerability exposes detailed workout information, including slot entry IDs, iteration values, operations, step counts, repeat flags, and requirements JSON.
The vulnerability has been fixed in commit 1fda5690b35706bb137850c8a084ec6a13317b64, which adds the necessary user filtering to the queryset methods of the affected viewsets.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wger wger | <= 2.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 3, 2026 | Initial Analysis | [email protected] |
| Feb 26, 2026 | New CVE Received | [email protected] |