wger CVE-2026-82544

Exploitation requires: (1) the victim holds an authenticated wger session with gym trainer or administrator privileges that include access to the reset_user_password view; (2) the wger instance is running any version up to 2.6.0-alpha2 without the patched commit applied; and (3) the attacker can induce the authenticated trainer to load a URL referencing the password-reset endpoint - via phishing, a malicious advertisement, or a compromised external site - while their session is active. No non-default server configuration is required; any standard wger deployment with gym management enabled is vulnerable. Key limiting factors: an unauthenticated attacker cannot perform the reset directly (the view itself requires an authenticated trainer session); the attack is per-user, not bulk; and it requires successful social engineering of a privileged user.

The CVSS 4.0 score of 5.3 (Medium) is consistent with the realistic impact envelope: the attacker can force a password reset for individual gym members but cannot achieve code execution, data exfiltration, or availability disruption. The CVSS 4.0 vector (PR:N/UI:P) accurately captures the mechanics - no attacker-side privileges are required, but exploitation is gated entirely on luring an authenticated trainer or admin into loading attacker-controlled content. No EPSS score is present in the provided data, and no KEV entry or public POC exists, which aligns with the narrow deployment context and moderate complexity of social engineering required. The integrity impact is limited (VI:L) and confined to the vulnerable system (SC/SI/SA all N), meaning successful exploitation affects individual user accounts rather than the broader platform. The absence of any confidentiality impact is consistent with the patch diff, which shows no data disclosure path. Real-world priority is low for most organizations, though deployments where gym trainers regularly browse external content with active sessions warrant prompt patching.

An attacker targeting a specific gym member constructs a web page containing an image tag or anchor whose URL points to the wger password-reset endpoint for that member (e.g., https://gym.example.com/gym/reset-user-password/42/). The attacker sends a phishing message to a gym trainer, who clicks the link while holding an active wger session. The trainer's browser issues the GET request with their session cookie, silently resetting the target member's password without any CSRF token check. The attacker then uses a credential-reset flow to take over the member's account. No public POC has been identified at time of analysis.