CVE-2026-27838

Katalog CVE

CVSS 3.5 · Low EPSS 0,25%

Kerentanan Authorization Bypass Through User-Controlled Key pada wger. Skor CVSS 3.1 3.5 (Low) menurut NVD.

Deskripsi (NVD)

wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up to and including 2.4, ache keys are scoped only by `pk` — no user ID is included. When a victim has previously accessed their routine via the API, an attacker can retrieve the cached response for the same PK without any ownership check. Commit e964328784e2ee2830a1991d69fadbce86ac9fbf contains a patch for the issue.

Rincian

Terbit di NVD

26 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.5 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wger-project/wger/security/advisories/GHSA-42cr-w2gr-m54q exploit · advisory vendor
• https://github.com/wger-project/wger/commit/e964328784e2ee2830a1991d69fadbce86ac9fbf patch