wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639 and CWE-200.
Summary
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats/ that are intended to return data for the requesting user's own training history within a routine. However, the underlying permission check (RoutinePermission.has_object_permission) grants read access to any authenticated user when the routine has is_template=True, regardless of ownership. When the /logs/ or /stats/ actions are invoked against a routine the attacker does not own, they return the owner's private workout history, not the attacker's. This issue has been fixed in version 2.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wger-project | wger | before 2.6 | 2.6 | Patch available | CNA |
| — | wger (PyPI) | up to 2.5 | — | No fix listed | GHSA-cj9g-27ph-4cgv |
- wger Vendorwger-project Affected before 2.6 Fixed in 2.6 Patch available CNA
- wger (PyPI) Vendor— Affected up to 2.5 Fixed in — No fix listed GHSA-cj9g-27ph-4cgv
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* | — | — | wger-project |
- cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* Versions — — ·wger-project
Remediation
- Fix · CNA wger (wger-project) Fixed in 2.6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-43977
- 2026-10-03 Alias added: GHSA-cj9g-27ph-4cgv
- 2026-11-06 Weakness changed · GHSA-cj9g-27ph-4cgv
- 2026-11-06 5 new references · GHSA-cj9g-27ph-4cgv
References
Advisory 2
Other 5
- https://github.com/wger-project/wger/security/advisories/GHSA-cj9g-27ph-4cgv
- https://github.com/wger-project/wger/commit/47d646c24178783eb6787ecf26e79dc8f4a394c6
- https://github.com/pypa/advisory-database/tree/main/vulns/wger/PYSEC-2026-3421.yaml
- https://github.com/wger-project/wger
- https://pypi.org/project/wger
More wger-project vulnerabilities
- TI-2026-32005 wger: cross-tenant password reset and plaintext disclosure via gym=None bypass CVSS 3.1CRITICAL 9.9
- TI-2022-02450 Improper Restriction of Excessive Authentication Attempts in wger-project/wger CVSS 3.1CRITICAL 9.8
- TI-2023-20093 Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager… CVSS 3.1HIGH 8.8
- TI-2026-32022 wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers CVSS 3.1HIGH 8.1
- TI-2026-29226 wger has Broken Access Control in the Global Gym Configuration Update Endpoint CVSS 3.1HIGH 7.6
- TI-2026-69145 wger: Trainer Privilege Escalation through Improper Privilege Management CVSS 3.1HIGH 7.1
Sources
- CVE-2026-43977 · CVE Program
- CVE-2026-43977 · NVD
- FIRST EPSS
- GHSA-cj9g-27ph-4cgv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences