CVE-2026-27839

wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three "nutritionalvalues" action endpoints fetch objects via "Model.objects.getpk=pk" — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private...