Cache Exposure in wger Workout and Fitness Manager

CVE-2026-27838

What is CVE-2026-27838?

The wger Workout and Fitness Manager, an open-source application for managing workouts, has a vulnerability that allows attackers to exploit cached responses. Specifically, five routine detail action endpoints fail to include user ID in the cache key, which is only scoped by the primary key (pk). This means that if a user has previously accessed their routine via the API, an attacker can retrieve the cached response for the same pk. The lack of ownership checks may lead to unauthorized access to sensitive routine information. A patch for this issue has been implemented in commit e964328784e2ee2830a1991d69fadbce86ac9fbf.

References