CVE-2026-27839— wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-27839
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
Source: CVE Program / CVE List V5
Vulnerability Description
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Model.objects.get(pk=pk)` — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e contains a fix for the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
wger 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
wger是wger Project开源的使用 Django 编写的自托管 FLOSS 健身/锻炼、营养和体重追踪器。 wger 2.4及之前版本存在安全漏洞，该漏洞源于绕过用户作用域查询集，可能导致读取其他用户数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| wger-project | wger | <= 2.4 | - |
II. Public POCs for CVE-2026-27839
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-27839
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-27839 (1)
Same Patch Batch · wger-project · 2026-02-26 · 3 CVEs total
| CVE-2026-27835 | 4.3 MEDIUM | wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout dat |
| CVE-2026-27838 | 3.1 LOW | wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data |
IV. Related Vulnerabilities
Same product: wger
- CVE-2026-43977
wger IDOR: Authenticated Users Can Read Others' Private Work - CVE-2026-43978
wger: Privilege escalation via trainer-login session chainin - CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure v - CVE-2026-40474
wger has Broken Access Control in the Global Gym Configurati - CVE-2026-40353
wger: Stored XSS via Unescaped License Attribution Fields
Same vendor: wger-project
- CVE-2026-43977
wger IDOR: Authenticated Users Can Read Others' Private Work - CVE-2026-43978
wger: Privilege escalation via trainer-login session chainin - CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure v - CVE-2026-40474
wger has Broken Access Control in the Global Gym Configurati - CVE-2026-40353
wger: Stored XSS via Unescaped License Attribution Fields
Same weakness: CWE-639
- CVE-2026-61574
authentik RAC: access any endpoint via an unrelated applicat - CVE-2026-19869
Privilege Escalation via Dropped Field-Level @authentication - CVE-2026-49223
Vvveb product review authorization bypass allows Vendors to - CVE-2026-49224
Vvveb post revision authorization bypass allows Authors to r - CVE-2026-49222
Vvveb product question authorization bypass allows Vendors t
V. Comments for CVE-2026-27839
No comments yet