wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup

Vulnerability Description: Three nutritional_values action endpoints in wger's nutrition API (NutritionPlanViewSet, MealViewSet, MealItemViewSet) bypass object-level permissions by directly calling Model.objects.get(pk=pk) instead of using self.get_object() to enforce user scoping. This allows any authenticated user to supply an arbitrary primary key (PK) and retrieve another user's private nutrition plan data, including caloric intake and macro breakdown. The flaw affects versions up to and including 2.4 [1][3].

Exploitation Method: An attacker only needs a valid authentication token (e.g., from a registered account). The PKs are sequential integers, making enumeration trivial. By sending GET requests to endpoints like /api/v2/nutritionplan/{pk}/nutritional_values/, the attacker can iterate through PKs and obtain other users' dietary data without any victim interaction [3]. Open registration by default increases the attack surface.

Impact: Exposure of sensitive dietary and health information: daily caloric intake, protein, carbohydrates, fat, fiber, sodium, and full meal composition. This violates user privacy and could be leveraged for targeted harassment or competitive advantage in fitness contexts [3].

Mitigation: The fix, introduced in commit 29876a1954fe959e4b58ef070170e81703dab60e, replaces the raw ORM call with self.get_object(), which applies the correct owner-based queryset filtering [4]. Users should update to a patched version or apply the commit manually. No workaround is available; the endpoints are fixed only after patching.