Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Model.objects.get(pk=pk)` — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e contains a fix for the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27839 wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Model.obj… https://www.cve.org/CVERecord?id=CVE-2026-27839
Post summary
The post announces CVE-2026-27839 in wger versions up to 2.4, noting that certain nutritional_values endpoints use Model.obj, but it provides no further technical or remediation details.
CVE-2026-27839: Lifting the Lid on wger: IDOR in the Nutrition API A classic Insecure Direct Object Reference (IDOR) vulnerability in the 'wger' workout manager allows authenticated users to access the nutritional plans of any other user. By bypassing... https://cvereports.com/reports/CVE-2026-27839
Post summary
The report discloses an IDOR vulnerability in the wger Nutrition API that permits authenticated users to view other users’ nutritional plans, but it provides no proof‑of‑concept, exploit code, active exploitation evidence, or patch information.
CVE-2026-27839 Authenticated Nutrition Plan Data Disclosure in wger Fitness Manager Before 2.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27839
Post summary
A CVE-2026-27839 vulnerability in wger Fitness Manager (before version 2.4) permits authenticated users to disclose nutrition plan data, as reported by Vulmon.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wger | wger | - | - | - |