Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up to and including 2.4, ache keys are scoped only by `pk` — no user ID is included. When a victim has previously accessed their routine via the API, an attacker can retrieve the cached response for the same PK without any ownership check. Commit e964328784e2ee2830a1991d69fadbce86ac9fbf contains a patch for the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27838 wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up to and … https://www.cve.org/CVERecord?id=CVE-2026-27838
Post summary
The post references CVE‑2026‑27838, noting a cache check before self.get_object() in wger’s routine detail endpoints, but provides no PoC, exploit, or patch details.
CVE-2026-27838: Leaking Gains: The Cached IDOR in wger Fitness Manager A classic case of 'premature optimization' leading to security failure. In the wger fitness manager, a caching mechanism designed to speed up API responses inadvertantly bypassed a... https://cvereports.com/reports/CVE-2026-27838
Post summary
The report identifies an IDOR flaw in wger Fitness Manager stemming from a caching oversight, but provides no PoC, exploit code, active exploitation evidence, or patch information.
CVE-2026-27838 Unauthorized Routine Access via Cached Response in wger Fitness Manager API https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27838
Post summary
The post announces the discovery of CVE‑2026‑27838, a vulnerability that allows unauthorized routine access through cached responses in the wger Fitness Manager API.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wger | wger | - | - | - |