Wger
Monthly
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded `date_sequence` while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. No public exploit code has been released independently, though the GHSA advisory itself contains a complete, weaponizable step-by-step PoC including exact API payloads.
CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadsheet formulas into their own first_name or last_name profile fields, which are then reproduced verbatim in the TSV export file. When a gym administrator opens the exported file in Excel, LibreOffice Calc, or Google Sheets, the formula executes in the admin's local spreadsheet context, enabling data exfiltration via =HYPERLINK callbacks and, on legacy Excel deployments with DDE enabled, arbitrary local code execution. No public exploit code has been independently verified beyond the researcher's proof-of-concept described in the GHSA advisory; this vulnerability is not listed in the CISA KEV catalog.
Open redirect in wger's trainer_login view allows an attacker to redirect an authenticated trainer's browser to an arbitrary external domain immediately after impersonation mode is established. The root cause is in `wger/core/views/user.py` (~line 203), where `HttpResponseRedirect(request.GET['next'])` is called without invoking Django's `url_has_allowed_host_and_scheme()` guard, allowing any URL - including off-host ones - to be supplied via the `?next=` GET parameter. Beyond phishing, the redirect leaks the wger instance URL structure and the impersonated user's `user_pk` through the browser's Referer header; a working PoC is confirmed in the GHSA advisory, though no active exploitation has been reported.
Incomplete authorization fix in wger through master exposes three user-management views in wger/core/views/user.py to the same None != None gym-scope bypass previously identified in CVE-2026-43948 (GHSA-mhc8-p3jx-84mm). A gym staff member holding gym.manage_gym permission whose account has gym=None - the default unlinked state for any newly provisioned staff account - can permanently delete, deactivate, or re-activate any other user also carrying gym=None, exploiting a raw integer comparison that evaluates None != None as False instead of blocking the operation. No vendor-released patch has been identified at time of analysis; all wger versions through the master Docker image build of 2026-05-08 are confirmed affected.
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's password to be reset by tricking an authenticated trainer or admin into loading a malicious URL. The vulnerable `reset_user_password` view in `wger/gym/views/gym.py` performed its state-changing operation via HTTP GET, which Django's CSRF middleware does not protect by design. The upstream fix - commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 - converts the action to a POST-based confirmation form with full CSRF token enforcement; no public exploit and no CISA KEV listing have been identified at time of analysis.
Wger versions up to 2.4 allow authenticated users to access other users' private nutrition plans through insecure direct object references in the nutritional_values endpoints, exposing sensitive dietary data including caloric intake and macronutrient breakdowns. The vulnerability stems from bypassing user-scoped querysets via direct primary key lookups, and public exploit code is available.
wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. [CVSS 3.1 LOW]
Wger versions up to 2.4 expose all users' repetition configuration data to any authenticated attacker due to missing authorization checks in the RepetitionsConfigViewSet and MaxRepetitionsConfigViewSet endpoints. A registered user can enumerate the complete workout structures of all other users on the platform. Public exploit code exists for this vulnerability, and a patch is available.
Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function in the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded `date_sequence` while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. No public exploit code has been released independently, though the GHSA advisory itself contains a complete, weaponizable step-by-step PoC including exact API payloads.
CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadsheet formulas into their own first_name or last_name profile fields, which are then reproduced verbatim in the TSV export file. When a gym administrator opens the exported file in Excel, LibreOffice Calc, or Google Sheets, the formula executes in the admin's local spreadsheet context, enabling data exfiltration via =HYPERLINK callbacks and, on legacy Excel deployments with DDE enabled, arbitrary local code execution. No public exploit code has been independently verified beyond the researcher's proof-of-concept described in the GHSA advisory; this vulnerability is not listed in the CISA KEV catalog.
Open redirect in wger's trainer_login view allows an attacker to redirect an authenticated trainer's browser to an arbitrary external domain immediately after impersonation mode is established. The root cause is in `wger/core/views/user.py` (~line 203), where `HttpResponseRedirect(request.GET['next'])` is called without invoking Django's `url_has_allowed_host_and_scheme()` guard, allowing any URL - including off-host ones - to be supplied via the `?next=` GET parameter. Beyond phishing, the redirect leaks the wger instance URL structure and the impersonated user's `user_pk` through the browser's Referer header; a working PoC is confirmed in the GHSA advisory, though no active exploitation has been reported.
Incomplete authorization fix in wger through master exposes three user-management views in wger/core/views/user.py to the same None != None gym-scope bypass previously identified in CVE-2026-43948 (GHSA-mhc8-p3jx-84mm). A gym staff member holding gym.manage_gym permission whose account has gym=None - the default unlinked state for any newly provisioned staff account - can permanently delete, deactivate, or re-activate any other user also carrying gym=None, exploiting a raw integer comparison that evaluates None != None as False instead of blocking the operation. No vendor-released patch has been identified at time of analysis; all wger versions through the master Docker image build of 2026-05-08 are confirmed affected.
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's password to be reset by tricking an authenticated trainer or admin into loading a malicious URL. The vulnerable `reset_user_password` view in `wger/gym/views/gym.py` performed its state-changing operation via HTTP GET, which Django's CSRF middleware does not protect by design. The upstream fix - commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 - converts the action to a POST-based confirmation form with full CSRF token enforcement; no public exploit and no CISA KEV listing have been identified at time of analysis.
Wger versions up to 2.4 allow authenticated users to access other users' private nutrition plans through insecure direct object references in the nutritional_values endpoints, exposing sensitive dietary data including caloric intake and macronutrient breakdowns. The vulnerability stems from bypassing user-scoped querysets via direct primary key lookups, and public exploit code is available.
wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. [CVSS 3.1 LOW]
Wger versions up to 2.4 expose all users' repetition configuration data to any authenticated attacker due to missing authorization checks in the RepetitionsConfigViewSet and MaxRepetitionsConfigViewSet endpoints. A registered user can enumerate the complete workout structures of all other users on the platform. Public exploit code exists for this vulnerability, and a patch is available.
Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function in the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.