CVE-2026-46438

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error. Because `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with no user filter, the attacker's injected data is silently folded into the victim's progressive-overload calculations, corrupting their auto-generated weight and repetition targets. Version 2.6 contains a patch.

• CWE-639
• CWE-862

• https://github.com/wger-project/wger/releases/tag/2.6
• https://github.com/wger-project/wger/security/advisories/GHSA-rjpf-7pf5-q54x
• https://github.com/wger-project/wger/security/advisories/GHSA-rjpf-7pf5-q54x

Published

Oct 7, 2026

Last Modified

Oct 7, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46430Algernon is a small self-contained pure-Go web server. Prior…4.3
• CVE-2026-46431Algernon is a small self-contained pure-Go web server. Prior…4.3
• CVE-2026-46432LMDeploy is a toolkit for compressing, deploying, and servin…7.8
• CVE-2026-46433lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to …6.5
• CVE-2026-46434wger is a free, open-source workout and fitness manager. Pri…7.1
• CVE-2026-46437wger is a free, open-source workout and fitness manager. Ver…4.8
• CVE-2026-46439compliance-trestle is a tooling platform for managing compli…7.8
• CVE-2026-4644A Missing Authorization vulnerability in HTTP Connector in G…8.5
• CVE-2026-46440Flowise is a drag & drop user interface to build a customize…9.1
• CVE-2026-46441Flowise is a drag & drop user interface to build a customize…9.6
• CVE-2026-46442Flowise is a drag & drop user interface to build a customize…9.9
• CVE-2026-46443Flowise is a drag & drop user interface to build a customize…6.5