CVE-2026-27839

CVE-2026-27839 affects wger, an open-source workout and fitness manager, in versions up to and including 2.4. It allows any authenticated user to access other users' private nutrition plan data, including caloric intake and macro breakdowns, by exploiting a flaw in how specific API endpoints retrieve objects. The vulnerability has a CVSS score of 4.3 (MEDIUM), indicating a low attack complexity and requiring only low privileges for exploitation, resulting in a low impact on confidentiality. There is no impact on integrity or availability. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal.