https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 22:20:42 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-46438 <p>wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user&#39;s `SlotEntry` by supplying the victim&#39;s `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error. Because `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with no user filter, the attacker&#39;s injected data is silently folded into the victim&#39;s progressive-overload calculations, corrupting their auto-generated weight and repetition targets. Version 2.6 contains a patch.</p> <p>wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user&#39;s `SlotEntry` by supplying the victim&#39;s `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error. Because `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with no user filter, the attacker&#39;s injected data is silently folded into the victim&#39;s progressive-overload calculations, corrupting their auto-generated weight and repetition targets. Version 2.6 contains a patch.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-46438 https://vulnerability.circl.lu/vuln/ghsa-rjpf-7pf5-q54x <p><strong>Affected:</strong> PyPI: wger</p> <p>### Summary</p> <p>An authenticated attacker can inject arbitrary workout log entries into any other user&#39;s `SlotEntry` by supplying the victim&#39;s `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error.</p> <p>Because `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with **no user filter**, the attacker&#39;s injected data is silently folded into the victim&#39;s progressive-overload calculations, corrupting their auto-generated weight and repetition targets.</p> <p>### Details</p> <p>wger uses a centralized ownership-verification pattern in `WgerOwnerObjectModelViewSet.create()` (file: `wger/utils/viewsets.py`). This method iterates over the list returned by each ViewSet&#39;s `get_owner_objects()` and verifies that every listed foreign-key value in the request belongs to the authenticated user. **Foreign keys not present in the list are never checked.**</p> <p>`WorkoutLogViewSet.get_owner_objects()` returns:</p> <p>```python # File: wger/manager/api/views.py, lines 312-316 def get_owner_objects(self): return [(Routine, &#39;routine&#39;), (WorkoutSession, &#39;session&#39;)] # ^^^^^^^ checked ^^^^^^^^^^^^^^^ checked # (SlotEntry, &#39;slot_entry&#39;) is MISSING ```</p> <p>Because `slot_entry` is omitted, an attacker can supply their own `routine` (which passes the ownership check) alon…</p> <p><strong>Affected:</strong> PyPI: wger</p> <p>### Summary</p> <p>An authenticated attacker can inject arbitrary workout log entries into any other user&#39;s `SlotEntry` by supplying the victim&#39;s `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error.</p> <p>Because `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with **no user filter**, the attacker&#39;s injected data is silently folded into the victim&#39;s progressive-overload calculations, corrupting their auto-generated weight and repetition targets.</p> <p>### Details</p> <p>wger uses a centralized ownership-verification pattern in `WgerOwnerObjectModelViewSet.create()` (file: `wger/utils/viewsets.py`). This method iterates over the list returned by each ViewSet&#39;s `get_owner_objects()` and verifies that every listed foreign-key value in the request belongs to the authenticated user. **Foreign keys not present in the list are never checked.**</p> <p>`WorkoutLogViewSet.get_owner_objects()` returns:</p> <p>```python # File: wger/manager/api/views.py, lines 312-316 def get_owner_objects(self): return [(Routine, &#39;routine&#39;), (WorkoutSession, &#39;session&#39;)] # ^^^^^^^ checked ^^^^^^^^^^^^^^^ checked # (SlotEntry, &#39;slot_entry&#39;) is MISSING ```</p> <p>Because `slot_entry` is omitted, an attacker can supply their own `routine` (which passes the ownership check) alon…</p> https://vulnerability.circl.lu/vuln/ghsa-rjpf-7pf5-q54x