CVE-2026-46438 · GHSA-rjpf-7pf5-q54x
wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry
- Risk score
- 52/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slot_entry ID in a POST /api/v2/workoutlog/ request. The slot_entry foreign key is not included in the ownership ve…
- Affected
- wger (pip) <= 2.1
- Fix
- No patched version listed yet: check the advisory for mitigations.
- Exploitation
- Public proof of concept
Story map
At a glance
wger: Yellow, plan it in. wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gym_trainer permission can deactivate any account in the same gym, including gym_manager and general_gym_manager accounts. The UserDeactivateView grants access to anyone holding any one of gym.manage_gym, gym.manage_gym…
The flaws
- CVE-2026-46438: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry (CVSS 6.5 · EPSS 0%)
- CVE-2026-46434: Trainer Privilege Escalation - Improper Privilege Management (CVSS 7.1 · EPSS 0%)
- CVE-2026-43976: Cross-tenant admin notes/contracts leak via gym=None bypass (5 views) (CVSS 7.1 · EPSS 0%)
- CVE-2026-46437: API credentials remain valid after logout/password change (CVSS 4.8 · EPSS 0%)
The fix
Upgrade wger: 2.6 or later on your release line
Who is exposed: wger (pip) <= 2.1
Where it stands
- Public proof of concept
Connects to
- Same weakness: Authorisation bypass (CWE-639). 246 other warnings in 30 days
Why it is Yellow
- CVSS 6.5 medium
- Public exploit or proof of concept referenced
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| wger | pip | <= 2.1 | No fix yet |
References
Original description
wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error. Because `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with no user filter, the attacker's injected data is silently folded into the victim's progressive-overload calculations, corrupting their auto-generated weight and repetition targets. Version 2.6 contains a patch.
Last activity 7 Oct 2026. Patch Forecast updates every hour.