wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API

Summary Any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own.The RoutinePermission class grants read access to any authenticated user when a routine has...

PT-2026-25668

Name of the Vulnerable Software and Affected Versions Campus Educativa affected versions not specified Description An Insecure Direct Object Reference IDOR issue exists in Campus Educativa. This allows an unauthenticated attacker to access user profile photos via manipulation of the URL at the AP...