wger CVE-2026-86255

The attacker must hold a valid authenticated account on the target wger instance (CVSS PR:L); in deployments with open self-registration this requires only completing account creation. No admin role, elevated permissions, or special feature flag is needed - any default user role can call the routine creation endpoint and the five triggering read endpoints. The unbounded date-range computation is triggered by standard documented API calls requiring only a valid Authorization token. Exploitation is limited to wger instances running a version before 2.5 that are network-reachable (AV:N). Instances that disable self-registration and strictly vet user accounts have a meaningfully higher practical barrier, as the attacker must control at least one legitimate credential.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) accurately reflects the threat model. Any account holder - including a self-registered user in open-registration deployments - can trigger the DoS; no elevated permissions are required. Attack complexity is low with no special configuration needed, and exploitation requires no user interaction beyond routine creation and a single GET request. The GHSA advisory includes a complete PoC with exact JSON payloads, which substantially lowers the practical exploitation threshold despite the absence of a separately released exploit tool. No CISA KEV listing exists and EPSS data was not provided in the input. Real-world risk is strongly modulated by deployment model: instances with open self-registration face a near-zero barrier beyond account creation, while SSO-gated or invite-only deployments require the attacker to already hold a legitimate account. The absence of scope change (S:U, SC:N) is appropriate - the DoS is confined to the wger application worker pool and does not affect the underlying OS or adjacent systems.

An attacker registers a free account on a public wger instance, POSTs a routine with start=2000-01-01 and end=2099-12-31, then fires concurrent GET requests to /api/v2/routine/<id>/date-sequence-display/ using tools such as curl or a simple Python script. Each request occupies a gunicorn worker for several seconds while the server iterates 36,525 days; with enough concurrent requests the attacker saturates all worker threads, causing HTTP 503 errors for all other users. The GHSA advisory includes exact JSON payloads making this trivially reproducible.