Vulnerability Description
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Model.objects.get(pk=pk)` — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e contains a fix for the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wger | Wger | <= 2.4 |
Related Weaknesses (CWE)
References
- https://github.com/wger-project/wger/commit/29876a1954fe959e4b58ef070170e81703daPatch
- https://github.com/wger-project/wger/security/advisories/GHSA-g8gc-6c4h-jg86ExploitVendor Advisory
FAQ
What is CVE-2026-27839?
CVE-2026-27839 is a vulnerability with a CVSS score of 4.3 (MEDIUM). wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Model.objects.get(pk=pk)` — a raw ORM call ...
How severe is CVE-2026-27839?
CVE-2026-27839 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27839?
Check the references section above for vendor advisories and patch information. Affected products include: Wger Wger.