EUVD-2026-68219
GHSA-frcw-fw5q-gh4g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered CSRF requiring interaction from an authenticated privileged user; attacker needs no credentials; impact limited to integrity of individual password records.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This patch is called 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314. It is advisable to implement a patch to correct this issue.
AnalysisAI
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's password to be reset by tricking an authenticated trainer or admin into loading a malicious URL. The vulnerable reset_user_password view in wger/gym/views/gym.py performed its state-changing operation via HTTP GET, which Django's CSRF middleware does not protect by design. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the victim holds an authenticated wger session with gym trainer or administrator privileges that include access to the `reset_user_password` view; (2) the wger instance is running any version up to 2.6.0-alpha2 without the patched commit applied; and (3) the attacker can induce the authenticated trainer to load a URL referencing the password-reset endpoint - via phishing, a malicious advertisement, or a compromised external site - while their session is active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) is consistent with the realistic impact envelope: the attacker can force a password reset for individual gym members but cannot achieve code execution, data exfiltration, or availability disruption. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix by deploying a build that includes commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314, available via pull request https://github.com/wger-project/wger/pull/2415. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2. Rated cri
Wger versions up to 2.4 allow authenticated users to access other users' private nutrition plans through insecure direct
Wger versions up to 2.4 expose all users' repetition configuration data to any authenticated attacker due to missing aut
wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calli
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today