wger

Workout plans lost in notes and spreadsheets? 🏋️ wger helps track routines, body weight and nutrition, with a self-hosted option. Keep it all together. 📊 wger-project/wger #Fitness #浇朋友 #蓝朋友 #互关 #fo

健身计划写在备忘录里，记录起来太乱？🏋️ wger 能管理训练动作、计划、体重和饮食记录，还支持自托管。📊 wger-project/wger #Fitness #浇朋友 #蓝朋友 #互关 #fo

CVE-2026-46438: CVE-2026-46438: Broken Object Level Authorization in wger Workout Log Endpoint CVE-2026-46438: Broken Object Level Authorization in wger Workout Log Endpoint > Vulnerability ID: CVE-2026-46438 > CVSS Score: 6.5 > Published: 2026-10-07 CVE-2026-46438 is a critical Broken Object Level Authorization (BOLA) / Insecure Direct Object Reference (IDOR) vulnerability identified in the wger fitness manager prior to version 2.6. An authenticated attacker can exploit a missing authorization check on the slot_entry API parameter to inject unauthorized workout logs into another user's training schedule. This results in the corruption of the target user's automated progressive-overload calculations. TL;DR Missing validation in wger's API endpoints allows authenticated users to inject unauthorized training logs into any user's workout schedule by referencing their slot_entry ID, corrupting dynamic progressive-overload configurations. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-862 (Missing Authorization) - Attack Vector: Network - CVSS v3.1: 6.5 (Medium) - Exploit Status: Proof of Concept (PoC) available - Remediation: Official upgrade path to version 2.6 Affected Systems - wger-project/wger - wger: < 2.6 (Fixed in: 2.6) Code Analysis Commit: b29cf17 Fix ownership checks for workout logs and slot entries Mitigation Strategies - Restrict user ownership configurations on all related sub-objects at both the controller layer and model validation layer. - Isolate internal query relationships in calculation engines by strictly scoping lookups to the routine's owner user. Remediation Steps: 1. Upgrade the wger environment to version 2.6 or later. 2. Audit active databases for existing cross-user references within the WorkoutLog tables and prune inconsistent records. 3. Enable monitoring for HTTP 403 Forbidden responses on the workout log REST API endpoints. References - GitHub Security Advisory GHSA-rjpf-7pf5-q54x - Patch Commit b29cf178651bbcc243d21673932e32bd42017893 --- Read the full report for CVE-2026-46438 on our website for more details including interactive diagrams and full exploit analysis.

爱身子的朋友们，这两款开源健身神器到底该怎么选？🤔🔥 🏋️ openGym（4.1k★）： 专注力量训练，递进规则、肌肉恢复图、RIR/RPE，一条 docker 命令跑起来，通行密钥登录 ⏬ DuarteSantos8/openGym 🥗 wger（6.9k★）： 训练+饮食热量+体重+进度照，商店有官方 App，还能做多用户的 ⏬ wger-project/wger 练得细选前者，管得全选后者。你用哪个？🤔