Threats tagged 'ghsa-cj9g-27ph-4cgv'

wger contains an insecure direct object reference (IDOR) vulnerability allowing any authenticated user to access private workout session notes, exercise logs, and training statistics of other users who have public template routines. The API endpoints /logs/ and /stats/ return the owner’s personal data instead of the requesting user's data when accessed on a template routine. This exposes sensitive health-related personal data, constituting a privacy breach.