CVE-2026-27839: wger Package IDOR Vulnerability Exposes Private Dietary Data
Summary
CVE-2026-27839: wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup. Affects wger versions < 2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wger package is an open-source application designed for managing dietary plans and nutrition tracking. It allows users to create and maintain personalized nutrition plans, log meals, and track caloric intake. However, the application has a critical vulnerability that can expose sensitive user data due to improper access controls.
Vulnerability Detail
The vulnerability arises from three endpoints in the wger application that fetch nutritional values using raw ORM calls without proper user-scoped queryset filtering. This allows any authenticated user to access another user's private dietary data by simply supplying an arbitrary primary key (PK). The affected endpoints are: GET /api/v2/nutritionplan/{pk}/nutritional_values/, GET /api/v2/meal/{pk}/nutritional_values/, and GET /api/v2/mealitem/{pk}/nutritional_values/. The implications of this vulnerability are severe, as it permits unauthorized access to sensitive health information, including daily caloric intake and detailed macro breakdowns.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected endpoints by implementing additional authentication checks or by disabling the endpoints until a proper fix is applied.
Conclusion
The wger package has a significant vulnerability that can lead to unauthorized access to sensitive dietary data. It is crucial for users to update their applications or implement the recommended fixes to protect user privacy and comply with security best practices.
See every vulnerability recorded for wger →
FAQ
CVE-2026-27839 is a vulnerability in the wger package that allows authenticated users to access other users' private dietary data due to improper access controls.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can expose sensitive health information, including daily caloric intake, macro breakdowns, and full meal compositions.
The CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
Update the wger package to the latest version that includes the fix, or modify the affected code to enforce proper access controls.
References
Related vulnerabilities
Recent vulnerabilities recorded for wger.
