CERT24GHSA-rjpf-7pf5-q54x — wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entryLoading data…
CERT24Threat Observatory
Period

GHSA-rjpf-7pf5-q54x — wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

An authenticated attacker can inject arbitrary workout log entries into another user’s SlotEntry by supplying the victim’s slot_entry ID in a POST request to /api/v2/workoutlog/. This can corrupt the victim’s automatically generated weight and repetition targets.

← Back to intelligence

GHSA-rjpf-7pf5-q54x — wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

An authenticated attacker can inject arbitrary workout log entries into another user’s SlotEntry by supplying the victim’s slot_entry ID in a POST request to /api/v2/workoutlog/. This can corrupt the victim’s automatically generated weight and repetition targets.