CVE-2026-27838: fallo de gravedad baja en wger-project wger
wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 3.1epss 0.3%
wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up to and including 2.4, ache keys are scoped only by `pk` — no user ID is included. When a victim has previously accessed their routine via the API, an attacker can retrieve the cached response for the same PK without any ownership check. Commit e964328784e2ee2830a1991d69fadbce86ac9fbf contains a patch for the issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
wger-project · wgerCVEs relacionadas — wger-project wger
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-86255HIGHwger before 2.5 Uncontrolled Resource Consumption via date_sequenceEPSS 0.4%CVE-2026-43948CRITICALwger: cross-tenant password reset and plaintext disclosure via gym=None bypassEPSS 0.4%CVE-2026-86254MEDIUMwger Incomplete Authorization Fix Cross-Tenant Account DeletionEPSS 0.4%CVE-2026-40474HIGHwger has Broken Access Control in the Global Gym Configuration Update EndpointEPSS 0.3%CVE-2026-27839MEDIUMwger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookupEPSS 0.3%CVE-2026-27835MEDIUMwger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout dataEPSS 0.3%