Is CVE-2026-27838 actively exploited?

No active exploitation of CVE-2026-27838 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-27838 be exploited remotely?

Yes. CVE-2026-27838 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-27838?

CVE-2026-27838 has a CVSS score of 3.5 (LOW).

HOME VULNERABILITIESCVE-2026-27838

LOW

CVE-2026-27838

CWE-639Published: February 26, 2026· Updated: Mar 3, 2026

3.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:6.6th

Official Description

wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up to and including 2.4, ache keys are scoped only by `pk` — no user ID is included. When a victim has previously accessed their routine via the API, an attacker can retrieve the cached response for the same PK without any ownership check. Commit e964328784e2ee2830a1991d69fadbce86ac9fbf contains a patch for the issue.

NVD Source

Technical Analysis

CVE-2026-27838 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.