CVE-2026-27838: wger Package IDOR Vulnerability Exposes User Workout Data
Summary
CVE-2026-27838: wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data. Affects wger versions < 2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wger package is an open-source web application designed for managing workout routines and tracking fitness activities. It provides users with the ability to create, modify, and analyze their workout plans and statistics. However, it has been found to have a vulnerability that allows unauthorized access to user-specific workout data due to improper cache key management.
Vulnerability Detail
The vulnerability arises from an Insecure Direct Object Reference (IDOR) in the wger package, specifically in the routine detail action endpoints. These endpoints utilize a caching mechanism that only considers the primary key (pk) of the routine, without incorporating the user ID. As a result, if a victim user accesses their routine data, an attacker can exploit the cache to retrieve this data without any ownership verification. This flaw can lead to unauthorized access to sensitive workout details, including exercise structures, training logs, and statistics, potentially compromising user privacy.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can move the ownership verification check before the cache lookup in the affected endpoints. This ensures that the system always verifies user ownership before returning any cached data. The modified code snippet would look like this:
@action(detail=True)
def date_sequence_display_mode(self, request, pk=None):
routine = self.get_object() # Ownership check first
cache_key = make_routine_api_date_sequence_display_cache_key(pk, request.user.id)
cached = cache.get(cache_key)
if cached:
return Response(cached)
...
Conclusion
The wger package has a significant vulnerability (CVE-2026-27838) that allows unauthorized access to user workout data due to improper cache key management. It is crucial for users to update their packages and implement the recommended fixes to safeguard their data.
See every vulnerability recorded for wger →
FAQ
CVE-2026-27838 is a vulnerability in the wger package that allows unauthorized access to user workout data due to improper cache key management.
Users may have their sensitive workout details exposed to unauthorized individuals, compromising their privacy and data security.
An Insecure Direct Object Reference (IDOR) vulnerability occurs when an application exposes a reference to an internal object, allowing attackers to access or manipulate data without proper authorization.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 3.1, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for wger.
