CVE-2026-46438 wger-project CVE debrief

Who should care

Defenders responsible for wger installations, especially those with multiple users, should assess exposure and prioritize verification and compensating controls. This includes reviewing the vulnerability's impact on progressive-overload calculations and auto-generated targets, and ensuring appropriate measures are in place to mitigate potential data corruption.

Why it matters

Defenders should care about CVE-2026-46438 because it allows an authenticated attacker to inject arbitrary workout log entries into any other user's SlotEntry, potentially corrupting their auto-generated weight and repetition targets. This issue requires verification of exposure and assessment of compensating controls for wger installations, especially those with multiple users.

• Data corruption in progressive-overload calculations
• Silent folding of injected data into victim's auto-generated weight and repetition targets
• Potential for inaccurate workout log data
• Need for verification of exposure and compensating controls

Technical summary

The wger application does not perform adequate ownership checks on WorkoutLog.slot_entry, allowing an authenticated attacker to inject arbitrary workout log entries into any other user's SlotEntry. This is due to the slot_entry foreign key not being included in the ownership verification performed by WorkoutLogViewSet.get_owner_objects(). As a result, an attacker can corrupt progressive-overload calculations, leading to inaccurate auto-generated weight and repetition targets for victims' workout logs. The issue is addressed in version 2.6.

Defensive priority

Defenders should prioritize verifying exposure and assessing compensating controls for wger installations, especially those with multiple users.

Recommended defensive actions

• Verify wger installations for exposure, especially those with multiple users
• Assess compensating controls for wger installations
• Apply the patch in version 2.6 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and a patch in version 2.6. The issue is further confirmed by source references. Defenders should verify exposure and assess compensating controls, especially for wger installations with multiple users. Evidence is limited to public CVE details and associated source references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.