Is CVE-2026-46438 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46438 being exploited in the wild.

How severe is CVE-2026-46438?

Medium severity, with a CVSS score of 6.5, published 7 October 2026.

Which products and versions are affected?

wger (PyPI) <= 2.1, ECOSYSTEM:introduced=0,last_affected=2.1; Wger versions prior to patch.

How is CVE-2026-46438 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-46438?

Check whether you run wger (PyPI) or Wger at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46438: wger authorization bypass in workout log entry creation

Q: Which products and versions are affected?

wger (PyPI) <= 2.1, ECOSYSTEM:introduced=0,last_affected=2.1; Wger versions prior to patch.

Q: Is there a fix for CVE-2026-46438?

Yes: fixed in No fixed version specified in advisory. Until then: Add slot_entry to the ownership check list in WorkoutLogViewSet.get_owner_objects() and filter WorkoutLog queries by routine owner in SlotEntry.get_config_data(). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46438 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-46438?

Check whether you run wger (PyPI) or Wger at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46438 · Severity: medium · CVSS 6.5 · Published 2026-10-07

wger is a web-based workout manager that helps users track exercise routines and auto-generate training targets based on progression data. An authenticated attacker can inject fake workout entries into another user's training plan by bypassing ownership verification, causing the victim's auto-generated weight and repetition targets to become corrupted or dangerous.

Technologies: wger (PyPI), Wger. Vendors: PyPI, Wger.

Quick answers

Is CVE-2026-46438 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46438 being exploited in the wild.
How severe is CVE-2026-46438?: Medium severity, with a CVSS score of 6.5, published 7 October 2026.
Which products and versions are affected?: wger (PyPI) <= 2.1, ECOSYSTEM:introduced=0,last_affected=2.1; Wger versions prior to patch.
Is there a fix for CVE-2026-46438?: Yes: fixed in No fixed version specified in advisory. Until then: Add slot_entry to the ownership check list in WorkoutLogViewSet.get_owner_objects() and filter WorkoutLog queries by routine owner in SlotEntry.get_config_data(). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46438 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-46438?: Check whether you run wger (PyPI) or Wger at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: No fixed version specified in advisory

Add slot_entry to the ownership check list in WorkoutLogViewSet.get_owner_objects() and filter WorkoutLog queries by routine owner in SlotEntry.get_config_data().

Technical details

The vulnerability is a missing foreign-key ownership check in WorkoutLogViewSet.get_owner_objects(): the slot_entry field is not included in the ownership verification list, only routine and session are checked. An attacker can supply their own routine (which passes validation) alongside a victim's slot_entry ID (never verified) in a POST request. Additionally, SlotEntry.get_config_data() retrieves all linked WorkoutLog entries without filtering by user, so the attacker's injected logs silently corrupt the victim's progression calculations.

Affected products

wger wger versions prior to patch

Identifiers

CVE-2026-46438
GHSA-rjpf-7pf5-q54x
PYSEC-2026-4314

Timeline

2026-10-07: disclosed: GHSA-rjpf-7pf5-q54x published
2026-01-15: other: PoC demonstrates vulnerability with crafted POST request

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.