CVE-2026-46438: wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

An authenticated attacker can inject arbitrary workout log entries into any other user’s SlotEntry by supplying the victim’s slot_entry ID in a POST /api/v2/workoutlog/ request. The slot_entry foreign key is not included in the ownership verification performed by WorkoutLogViewSet.get_owner_objects(), so the server accepts and persists the cross-user reference without error.

Because SlotEntry.get_config_data() retrieves associated logs via self.workoutlog_set.all() with no user filter, the attacker’s injected data is silently folded into the victim’s progressive-overload calculations, corrupting their auto-generated weight and repetition targets.