wger CVE-2026-86256

The victim must hold an active, authenticated wger session with the gym.gym_trainer permission - anonymous or regular non-trainer users cannot reach the impersonation code path. The trainer must have at least one user under their management so that the trainer.identity branch executes. The attacker must deliver a crafted link to the trainer and the trainer must click it (UI:P); exploitation cannot be triggered server-side without the trainer's interaction. The ?next= parameter must be present in the GET request for the vulnerable branch to be taken; requests without a next parameter fall through to a safe default redirect. Limiting factors include the authentication barrier (trainer account required), the social engineering dependency, and the fact that impact is confined to browser-level redirect and passive information disclosure - there is no server-side execution path.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, score 5.1) accurately characterises the attack profile: network-reachable with low complexity, but gated behind an authenticated trainer session and a social-engineering step requiring the trainer to interact with a crafted link. The real-world risk is moderate-to-low: there is no direct server-side code execution, no privilege escalation within wger, and the attacker gains only indirect influence over the trainer's browser session. The PoC is publicly documented in the GHSA advisory, raising the likelihood of eventual opportunistic exploitation, but the requirement for a credentialed trainer target limits automation potential significantly. No EPSS data or CISA KEV entry is present in the available input, and no reports of active exploitation have surfaced; even a small gym management deployment should treat this as a routine patch-cycle priority rather than an emergency response, given that the blast radius is confined to phishing and passive user_pk disclosure rather than host compromise.

An attacker crafts the URL https://wger.target/en/user/2/trainer-login?next=https://evil.example/phish and delivers it to a trainer via email or a messaging platform. When the trainer - already authenticated with a valid session - clicks the link, wger sets the trainer.identity session key and issues an immediate 302 Found redirect to https://evil.example/phish; the trainer's browser follows the redirect, sending the Referer header https://wger.target/en/user/2/trainer-login which discloses the user_pk and instance URL. The attacker's page can then display a convincing wger login mimic to harvest credentials. A confirmed PoC demonstrating this exact flow is included in the GHSA advisory.