wger missing ownership check lets users inject logs into others' slot entries
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
wger before 2.6 does not check that a workout log's slot_entry belongs to the requesting user, so the server accepts the reference to another user's slot entry. (CWE-639) An authenticated attacker with a low privilege account and network access can add workout log entries to another user's slot entry. These injected entries then distort that user's automatically generated weight and repetition targets.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error. Because `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with no user filter, the attacker's injected data is silently folded into the victim's progressive-overload calculations, corrupting their auto-generated weight and repetition targets. Version 2.6 contains a patch.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wger-project | wger | before 2.6 | 2.6 | Patch available | CNA |
| — | wger (PyPI) | up to 2.1 | — | No fix listed | GHSA-rjpf-7pf5-q54x |
- wger Vendorwger-project Affected before 2.6 Fixed in 2.6 Patch available CNA
- wger (PyPI) Vendor— Affected up to 2.1 Fixed in — No fix listed GHSA-rjpf-7pf5-q54x
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* | — | — | wger-project |
- cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* Versions — — ·wger-project
Remediation
Upgrade wger to version 2.6 or later, which contains the patch.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA wger (wger-project) Fixed in 2.6
Timeline
- 2026-10-07 Threatist record created from CVE-2026-46438
- 2026-10-07 Alias added: GHSA-rjpf-7pf5-q54x
- 2026-10-07 Affected versions changed · GHSA-rjpf-7pf5-q54x
- 2026-10-07 CVSS score added · GHSA-rjpf-7pf5-q54x
- 2026-10-07 Weakness changed · GHSA-rjpf-7pf5-q54x
- 2026-10-07 3 new references · GHSA-rjpf-7pf5-q54x
- 2026-10-07 CISA SSVC decision points changed
References
Other 6
- https://github.com/wger-project/wger/security/advisories/GHSA-rjpf-7pf5-q54x
- https://github.com/wger-project/wger/releases/tag/2.6
- https://github.com/wger-project/wger/commit/b29cf178651bbcc243d21673932e32bd42017893
- https://github.com/pypa/advisory-database/tree/main/vulns/wger/PYSEC-2026-4314.yaml
- https://github.com/wger-project/wger
- https://pypi.org/project/wger
More wger-project vulnerabilities
- TI-2026-32005 wger: cross-tenant password reset and plaintext disclosure via gym=None bypass CVSS 3.1CRITICAL 9.9
- TI-2022-02450 Improper Restriction of Excessive Authentication Attempts in wger-project/wger CVSS 3.1CRITICAL 9.8
- TI-2023-20093 Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager… CVSS 3.1HIGH 8.8
- TI-2026-32021 wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API CVSS 3.1HIGH 7.5
- TI-2026-32022 wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers CVSS 3.1HIGH 8.1
- TI-2026-29226 wger has Broken Access Control in the Global Gym Configuration Update Endpoint CVSS 3.1HIGH 7.6
Sources
- CVE-2026-46438 · CVE Program
- CVE-2026-46438 · NVD
- FIRST EPSS
- GHSA-rjpf-7pf5-q54x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences