CVE-2026-27839
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Feb 26, 2026
CISA due date
—
The record
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Model.objects.get(pk=pk)` — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e contains a fix for the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | wger | 0 | No fix |
Related vulnerabilities
- GHSA-g8gc-6c4h-jg86 wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM… Same vulnerability
- CVE-2026-27838 wger is a free, open-source workout and fitness manager. Also affects wger
- CVE-2026-27835 wger is a free, open-source workout and fitness manager. Also affects wger
- GHSA-42cr-w2gr-m54q wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data Also affects wger
- GHSA-xf68-8hjw-7mpm wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout… Also affects wger
- CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before… CWE-639
- CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-639
- CVE-2026-105755 vLLM is an inference and serving engine for large language models. CWE-639