CVE-2026-27835
published 2026-02-26CVE-2026-27835: wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet`…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.26%
17.0th percentile
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` return all users' repetition config data because their `get_queryset()` calls `.all()` instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure. Commit 1fda5690b35706bb137850c8a084ec6a13317b64 contains a fix for the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wger-project | wger | <= 2.4 | — |
| wger | wger | <= 2.4 | — |
| wger | wger | 0 – 2.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
ghsa·2026-02-26
CVE-2026-27835 [MEDIUM] CWE-639 wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
### Summary
`RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` return all users' repetition config data because their `get_queryset()` calls `.all()` instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure.
### Details
`wger/manager/api/views.py:499` and `:518`:
```python
# VULNERABLE
class RepetitionsConfigViewSet(viewsets.ModelViewSet):
def get_queryset(self):
return RepetitionsConfig.objects.all()
class MaxRepetitionsConfigViewSet(viewsets.ModelViewSet):
def get_queryset(self):
return MaxRepetitionsConfig.objects.all()
```
Every sibling viewset in the same file correctly filters by user. For example, `WeightConfigView
OSV
wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
osv·2026-02-26
CVE-2026-27835 [MEDIUM] wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
### Summary
`RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` return all users' repetition config data because their `get_queryset()` calls `.all()` instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure.
### Details
`wger/manager/api/views.py:499` and `:518`:
```python
# VULNERABLE
class RepetitionsConfigViewSet(viewsets.ModelViewSet):
def get_queryset(self):
return RepetitionsConfig.objects.all()
class MaxRepetitionsConfigViewSet(viewsets.ModelViewSet):
def get_queryset(self):
return MaxRepetitionsConfig.objects.all()
```
Every sibling viewset in the same file correctly filters by user. For example, `WeightConfigView
No detection rules found.
No public exploits indexed.
2026-02-26
Published