CVE-2026-43977 wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API
Authenticated attackers can read other users' private workout data by accessing template routines, exposing sensitive training history.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-43977?
CVE-2026-43977 is a high-severity missing authorization vulnerability in wger-project wger, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats/ that are intended to return data for the requesting user's own training history within a routine. However, the underlying permission check (RoutinePermission.has_object_permission) grants read access to any authenticated user when the routine has is_template=True, regardless of ownership. When the /logs/ or /stats/ actions are invoked against a routine the attacker does not own, they return the owner's private workout history, not the attacker's. This issue has been fixed in version 2.6.
Which versions are affected by CVE-2026-43977?
3 open source packages ship an affected version, including wger.
| Package | Affected | Fixed in |
|---|---|---|
wger PyPI | All versions to 2.5 | None |
wger PyPI | All versions to 2.5 | None |
wger PyPI | All versions to 2.5 | None |
How do I fix CVE-2026-43977?
No fix has been published for CVE-2026-43977 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-43977 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43977 exists.
Sources
Also known as GHSA-cj9g-27ph-4cgv, PYSEC-2026-3421.