Vulnerability Description
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats/ that are intended to return data for the requesting user's own training history within a routine. However, the underlying permission check (RoutinePermission.has_object_permission) grants read access to any authenticated user when the routine has is_template=True, regardless of ownership. When the /logs/ or /stats/ actions are invoked against a routine the attacker does not own, they return the owner's private workout history, not the attacker's. This issue has been fixed in version 2.6.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/wger-project/wger/security/advisories/GHSA-cj9g-27ph-4cgv
- https://github.com/wger-project/wger/security/advisories/GHSA-cj9g-27ph-4cgv
FAQ
What is CVE-2026-43977?
CVE-2026-43977 is a vulnerability with a CVSS score of 7.5 (HIGH). wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statisti...
How severe is CVE-2026-43977?
CVE-2026-43977 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-43977?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.