Executive brief
wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data
Affected products
- PyPI wger
Junglewise Threat Intelligence
CVE-2026-27838: PYSEC-2026-3418 - wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data
CVE-2026-27838 · Severity: low · CVSS 3.1 · Published 2026-07-13
Technologies: wger (PyPI). Vendors: PyPI.
Related threats
- wger privilege escalation in trainer-login session chaining
- wger IDOR in RoutineViewSet logs and stats endpoints
- PYSEC-2026-3422 - wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
- PYSEC-2026-3423 - wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
- PYSEC-2026-573 - wger vulnerable to brute force attempts