Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` return all users' repetition config data because their `get_queryset()` calls `.all()` instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure. Commit 1fda5690b35706bb137850c8a084ec6a13317b64 contains a fix for the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27835 wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` return all … https://www.cve.org/CVERecord?id=CVE-2026-27835
Post summary
The CVE relates to a data exposure issue in wger's RepetitionsConfigViewSet and MaxRepetitionsConfigViewSet for versions up to 2.4, as noted in the CVE record.
CVE-2026-27835: CVE-2026-27835: Do You Even Lift? The wger Workout Leak A classic Insecure Direct Object Reference (IDOR) vulnerability in the wger Workout Manager allows authenticated users to access the repetition configurations of every other user ... https://cvereports.com/reports/CVE-2026-27835
Post summary
The post announces an IDOR flaw in the wger Workout Manager that lets authenticated users view other users’ repetition settings, without providing a PoC, exploit, or patch information.
CVE-2026-27835 Unauthorized User Repetition Config Enumeration in wger Fitness Manager Before 2.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27835
Post summary
The entry announces CVE-2026-27835, an unauthorized user repetition configuration enumeration vulnerability in wger Fitness Manager versions prior to 2.4, but provides no PoC, exploit, patch, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wger | wger | - | - | - |