Vulnerability · Published Feb 26, 2026 · Assigned by GitHub_M
CVE-2026-27839wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in wger from wger-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Model.objects.get(pk=pk)` — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e contains a fix for the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | wger | no fix listed | GHSA-g8gc-6c4h-jg86 |
| PyPI | wger | no fix listed | PYSEC-2026-3422 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wger-project | wger | <= 2.4 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N