Listen to this Post
How the mentioned CVE works:
The vulnerability resides in wger’s REST API permission logic.
RoutinePermission grants read access if routine.is_template=True.
Any authenticated user can view any template routine’s metadata.
The /logs/ and /stats/ endpoints reuse the same permission check.
However, these endpoints return the routine owner’s personal workout data.
The view calls self.get_object() which fetches the routine object.
Then logs_display() and calculate_log_statistics() operate on that object.
They do not filter by the requesting user (request.user).
Thus an attacker can supply a routine ID belonging to another user.
The attacker first enumerates all public templates via GET /api/v2/routine/?is_template=true.
This returns routine IDs, names, and owner info.
Next, the attacker calls GET /api/v2/routine/{id}/logs/.
The response contains the victim’s session notes, weights, reps, dates.
Similarly, /stats/ reveals training volume, intensity, and muscle-group breakdown.
The routine owner’s private health data is fully exposed.
No privilege escalation is required – a fresh free account works.
The IDOR stems from conflating template structure visibility with personal log data.
Root cause: missing user filter in logs_display() and calculate_log_statistics().
Fix requires passing request.user into those methods and denying non-owner access to logs/stats actions.
dailycve form:
Platform: wger
Version: <=2.5.0a2
Vulnerability: IDOR logs/stats
Severity: High
date: 2026-05-14
Prediction: 2026-06-13
What Undercode Say:
curl -X POST http://TARGET/api/v2/token -H “Content-Type: application/json” -d ‘{“username”:”attacker”,”password”:”pass”}’
curl -H “Authorization: Bearer $TOKEN” “http://TARGET/api/v2/routine/?is_template=true&is_public=true” | jq ‘.results[].id’
for id in $(curl -s -H “Authorization: Bearer $TOKEN” “http://TARGET/api/v2/routine/?is_template=true” | jq -r ‘.results[].id’); do
curl -s -H “Authorization: Bearer $TOKEN” “http://TARGET/api/v2/routine/$id/logs/” | jq ‘.[].session.notes’
done
python3 -c “import requests; …” (see PoC in )
how Exploit:
1. Register any user account, obtain JWT.
2. Enumerate public template routines: GET /api/v2/routine/?is_template=true
- For each routine ID, request /logs/ and /stats/ endpoints.
- Receive victim’s private workout notes, weights, reps, and training statistics.
Protection from this CVE
Upgrade to patched version (>=2.5.0a3). If unavailable, apply code fix: modify logs() and stats() actions to accept user=request.user. Update RoutinePermission to deny logs/stats for non-owners. Use API gateway rules to block /logs/ and /stats/ for templates.
Impact
Unauthorized access to workout session notes (personal health info). Exposure of full exercise history (weights, reps, dates). Leak of training statistics (volume, intensity). GDPR data breach violation. Reputational damage for platform.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
