CVE-2026-43977

wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats/ that are intended to return data for the requesting user's own training history within a routine. However, the underlying permission check (RoutinePermission.has_object_permission) grants read access to any authenticated user when the routine has is_template=True, regardless of ownership. When the /logs/ or /stats/ actions are invoked against a routine the attacker does not own, they return the owner's private workout history, not the attacker's. This issue has been fixed in version 2.6.

• CWE-639
• CWE-863

• https://github.com/wger-project/wger/security/advisories/GHSA-cj9g-27ph-4cgv
• https://github.com/wger-project/wger/security/advisories/GHSA-cj9g-27ph-4cgv

Published

Jul 16, 2026

Last Modified

Jul 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43969Improper Neutralization of CRLF Sequences ('CRLF Injection')…3.2
• CVE-2026-43970Improper Handling of Highly Compressed Data (Data Amplificat…8.2
• CVE-2026-43972Origin Validation Error vulnerability in ninenines gun (gun_…6.3
• CVE-2026-43973Uncontrolled Resource Consumption vulnerability in ninenines…8.7
• CVE-2026-43974Unexpected Status Code or Return Value vulnerability in nine…8.7
• CVE-2026-43975FolderUploadsFileManager in Apache Wicket does not validate …6.5
• CVE-2026-43978wger is a free, open-source workout and fitness manager. In …8.1
• CVE-2026-43979Local Deep Research is an AI-powered research assistant for …5
• CVE-2026-4398Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-43981Algernon is a small self-contained pure-Go web server. Prior…8.2
• CVE-2026-43982Algernon is a small self-contained pure-Go web server. Prior…8.7
• CVE-2026-43983Pocket ID is an OIDC provider that allows users to authentic…8.1