CVE-2026-43977: CWE-639: Authorization Bypass Through User-Controlled Key in wger-project wger
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats/ that are intended to return data for the requesting user's own training history within a routine. However, the underlying permission check (RoutinePermission.has_object_permission) grants read access to any authenticated user when the routine has is_template=True, regardless of ownership. When the /logs/ or /stats/ actions are invoked against a routine the attacker does not own, they return the owner's private workout history, not the attacker's. This issue has been fixed in version 2.6.
AI Analysis
Technical Summary
In wger versions before 2.6, the RoutineViewSet's custom actions /logs/ and /stats/ intended to provide a user's own training data improperly allow any authenticated user to read another user's private workout data if the routine has is_template=True. The underlying permission check RoutinePermission.has_object_permission incorrectly grants read access to all authenticated users for template routines, leading to an authorization bypass. This vulnerability is tracked as CVE-2026-43977 and has a CVSS 3.1 score of 7.5 (high severity). The issue was fixed in wger version 2.6.
Potential Impact
An attacker with any authenticated account can access private workout session notes, exercise history, and training statistics of other users by exploiting the authorization bypass in the /logs/ and /stats/ endpoints. This leads to unauthorized disclosure of sensitive user data without affecting integrity or availability.
Mitigation Recommendations
Upgrade wger to version 2.6 or later, where this authorization bypass vulnerability has been fixed. No other mitigation is indicated by the vendor advisory or data. Patch status is confirmed fixed in version 2.6.
CVE-2026-43977: CWE-639: Authorization Bypass Through User-Controlled Key in wger-project wger
Description
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats/ that are intended to return data for the requesting user's own training history within a routine. However, the underlying permission check (RoutinePermission.has_object_permission) grants read access to any authenticated user when the routine has is_template=True, regardless of ownership. When the /logs/ or /stats/ actions are invoked against a routine the attacker does not own, they return the owner's private workout history, not the attacker's. This issue has been fixed in version 2.6.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In wger versions before 2.6, the RoutineViewSet's custom actions /logs/ and /stats/ intended to provide a user's own training data improperly allow any authenticated user to read another user's private workout data if the routine has is_template=True. The underlying permission check RoutinePermission.has_object_permission incorrectly grants read access to all authenticated users for template routines, leading to an authorization bypass. This vulnerability is tracked as CVE-2026-43977 and has a CVSS 3.1 score of 7.5 (high severity). The issue was fixed in wger version 2.6.
Potential Impact
An attacker with any authenticated account can access private workout session notes, exercise history, and training statistics of other users by exploiting the authorization bypass in the /logs/ and /stats/ endpoints. This leads to unauthorized disclosure of sensitive user data without affecting integrity or availability.
Mitigation Recommendations
Upgrade wger to version 2.6 or later, where this authorization bypass vulnerability has been fixed. No other mitigation is indicated by the vendor advisory or data. Patch status is confirmed fixed in version 2.6.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-04T20:24:31.916Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a595c2d68715ace43d0b032
Added to database: 07/16/2026, 22:33:17 UTC
Last enriched: 07/16/2026, 22:47:49 UTC
Last updated: 08/29/2026, 22:52:11 UTC
Views: 87
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.