Medium severity4.3NVD Advisory· Published Feb 26, 2026· Updated Jun 17, 2026
CVE-2026-27839
CVE-2026-27839
Description
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three nutritional_values action endpoints fetch objects via Model.objects.get(pk=pk) — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e contains a fix for the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
wgerPyPI | <= 2.1 | — |
Affected products
3cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:*range: <=2.4
- (no CPE)range: <= 2.4
Patches
Vulnerability mechanics
References
4- github.com/wger-project/wger/commit/29876a1954fe959e4b58ef070170e81703dab60envdPatchWEB
- github.com/wger-project/wger/security/advisories/GHSA-g8gc-6c4h-jg86nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-g8gc-6c4h-jg86ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27839ghsaADVISORY
News mentions
0No linked articles in our index yet.