CVE-2026-27835

wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, "RepetitionsConfigViewSet" and "MaxRepetitionsConfigViewSet" return all users' repetition config data because their "getqueryset" calls ".all" instead of filtering by the authenticated user. Any register...