Moderate severityNVD Advisory· Published Feb 26, 2026· Updated Mar 3, 2026
wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
CVE-2026-27839
Description
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three nutritional_values action endpoints fetch objects via Model.objects.get(pk=pk) — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e contains a fix for the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
wgerPyPI | <= 2.1 | — |
Affected products
2- Range: <= 2.4
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-g8gc-6c4h-jg86ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27839ghsaADVISORY
- github.com/wger-project/wger/commit/29876a1954fe959e4b58ef070170e81703dab60eghsax_refsource_MISCWEB
- github.com/wger-project/wger/security/advisories/GHSA-g8gc-6c4h-jg86ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.