CVE-2026-27835: wger Package IDOR Vulnerability Exposes User Workout Data
Summary
CVE-2026-27835: wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data. Affects wger versions < 2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wger package is a web-based application designed for managing workout routines and tracking fitness progress. It allows users to create and customize workout plans, log exercises, and monitor their fitness journey. However, it has a vulnerability that can lead to unauthorized access to sensitive user data.
Vulnerability Detail
The vulnerability arises from the RepetitionsConfigViewSet and MaxRepetitionsConfigViewSet classes, which fail to filter repetition configuration data by the authenticated user. Instead of returning only the data relevant to the logged-in user, these viewsets return all users' repetition configurations. This oversight allows any registered user to enumerate and access the workout structures of other users, leading to a broken object-level authorization (BOLA) issue. The vulnerability is classified under CWE-639 and has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the API endpoints until the fix is implemented. This can be done by modifying the API permissions to limit access to only the authenticated user's data.
Conclusion
The wger package contains a significant vulnerability that allows unauthorized access to user workout data due to improper filtering in its API. It is crucial to apply the recommended fix and update the package to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for wger →
FAQ
The vulnerability allows authenticated users to access and enumerate other users' workout data due to improper filtering in the API.
You can check if your application is affected by using the Vulert playground at Vulert Scanner without any signup.
The potential impacts include unauthorized access to sensitive workout data, which can lead to privacy breaches and misuse of user information.
Yes, a patch is available. Update the wger package to the latest version that includes the fix for this vulnerability.
If you cannot update the package immediately, consider implementing temporary access restrictions to the affected API endpoints.
References
Related vulnerabilities
Recent vulnerabilities recorded for wger.
