wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's "SlotEntry" by supplying the victim's "slot_entry" ID in a "POST /api/v2/workoutlog/" request. The "slot_entry" foreign key is not included in the ownership verification performed by "WorkoutLogViewSet.get_owner_objects()", so the server accepts and persists the cross-user reference without error. Because "SlotEntry.get_config_data()" retrieves associated logs via "self.workoutlog_set.all()" with no user filter, the attacker's injected data is silently folded into the victim's progressive-overload calculations, corrupting their auto-generated weight and repetition targets. Version 2.6 contains a patch.