https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 19:48:05 +0000 https://cve.radiocsirt.org/vuln/cve-2026-43977 <p><strong>Affected:</strong> wger-project wger</p> <p>wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user&#39;s private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats/ that are intended to return data for the requesting user&#39;s own training history within a routine. However, the underlying permission check (RoutinePermission.has_object_permission) grants read access to any authenticated user when the routine has is_template=True, regardless of ownership. When the /logs/ or /stats/ actions are invoked against a routine the attacker does not own, they return the owner&#39;s private workout history, not the attacker&#39;s. This issue has been fixed in version 2.6.</p> <p><strong>Affected:</strong> wger-project wger</p> <p>wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user&#39;s private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats/ that are intended to return data for the requesting user&#39;s own training history within a routine. However, the underlying permission check (RoutinePermission.has_object_permission) grants read access to any authenticated user when the routine has is_template=True, regardless of ownership. When the /logs/ or /stats/ actions are invoked against a routine the attacker does not own, they return the owner&#39;s private workout history, not the attacker&#39;s. This issue has been fixed in version 2.6.</p> https://cve.radiocsirt.org/vuln/cve-2026-43977 https://cve.radiocsirt.org/vuln/pysec-2026-3421 <p><strong>Affected:</strong> PyPI: wger</p> <p>### Summary Any authenticated user can read another user&#39;s private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own.</p> <p>The RoutinePermission class grants read access to any authenticated user when a routine has is_template=True, regardless of ownership. The /logs/ and /stats/ API actions use the same permission check but return the routine owner&#39;s personal training data instead of the requesting user&#39;s data, creating an insecure direct object reference (IDOR).</p> <p>An attacker with a free account can enumerate all public template routine IDs via GET /api/v2/routine/?is_template=true, then call GET /api/v2/routine/{id}/logs/ and GET /api/v2/routine/{id}/stats/ to access the owner&#39;s private health data including workout notes, weights, repetitions, and performance statistics.</p> <p>### Description</p> <p>wger exposes a REST API endpoint that allows any authenticated user to retrieve the **private workout session notes, exercise logs, and training statistics** belonging to another user, as long as that user has at least one routine marked as a public template.</p> <p>The vulnerability exists in `RoutineViewSet` (`wger/manager/api/views.py`). The view defines two custom actions `/logs/` and `/stats/` that are intended to return data for the **requesting user&#39;s own** training history within a routine. However, the underlying permission check (`RoutinePermission.has_object_permission`) grants read access to **any…</p> <p><strong>Affected:</strong> PyPI: wger</p> <p>### Summary Any authenticated user can read another user&#39;s private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own.</p> <p>The RoutinePermission class grants read access to any authenticated user when a routine has is_template=True, regardless of ownership. The /logs/ and /stats/ API actions use the same permission check but return the routine owner&#39;s personal training data instead of the requesting user&#39;s data, creating an insecure direct object reference (IDOR).</p> <p>An attacker with a free account can enumerate all public template routine IDs via GET /api/v2/routine/?is_template=true, then call GET /api/v2/routine/{id}/logs/ and GET /api/v2/routine/{id}/stats/ to access the owner&#39;s private health data including workout notes, weights, repetitions, and performance statistics.</p> <p>### Description</p> <p>wger exposes a REST API endpoint that allows any authenticated user to retrieve the **private workout session notes, exercise logs, and training statistics** belonging to another user, as long as that user has at least one routine marked as a public template.</p> <p>The vulnerability exists in `RoutineViewSet` (`wger/manager/api/views.py`). The view defines two custom actions `/logs/` and `/stats/` that are intended to return data for the **requesting user&#39;s own** training history within a routine. However, the underlying permission check (`RoutinePermission.has_object_permission`) grants read access to **any…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3421