Quick answers
- Is CVE-2026-43977 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-43977 being exploited in the wild.
- How severe is CVE-2026-43977?
- High severity, with a CVSS score of 7.5, published 16 July 2026.
- Which products and versions are affected?
- wger (PyPI) <= 2.5, ECOSYSTEM:introduced=0,last_affected=2.5.
- Is there a fix for CVE-2026-43977?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-43977 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-43977?
- Check whether you run wger (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the RoutineViewSet of wger's REST API. The RoutinePermission.has_object_permission check incorrectly grants read access to any authenticated user if a routine is marked as a template (is_template=True), regardless of who owns the routine. While the /logs/ and /stats/ endpoints are intended to return the requesting user's data, the implementation calls logs_display() and calculate_log_statistics() on the routine object itself, which returns the owner's data instead. An attacker can enumerate public template IDs and retrieve the owner's private session notes, exercise history, and performance metrics. This issue is fixed in version 2.6.
Affected products
- wger-project wger < 2.6
Identifiers
- CVE-2026-43977
- GHSA-cj9g-27ph-4cgv
- PYSEC-2026-3421
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: NVD publication date