Wger Project
Monthly
Account-deactivation privilege escalation in wger before 2.6 lets an authenticated user who holds only the gym_trainer role disable higher-privileged accounts - including gym_manager and general_gym_manager - within the same gym, locking those users out of the application entirely. Access control on UserDeactivateView (and the mirror-image UserActivateView) uses OR logic across gym.manage_gym, gym.manage_gyms and gym.gym_trainer, with no privilege-hierarchy check and only a same-gym membership check in dispatch(), so the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - an insider/lower-privileged-role escalation, not a remote unauthenticated attack, and one that cannot cross gym boundaries. Publicly available exploit code exists (the vendor advisory itself publishes a working PoC of the GET request), but there is no confirmed active exploitation (CISA KEV) and no EPSS score was supplied in the intelligence feed; a gym manager provisioning a trainer account, which get_permission_list() always allows, is the amplifying path by which a trainer can then turn around and disable the manager who created it.
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded `date_sequence` while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. No public exploit code has been released independently, though the GHSA advisory itself contains a complete, weaponizable step-by-step PoC including exact API payloads.
Cross-user integrity corruption in wger versions prior to 2.6 allows authenticated attackers to inject arbitrary workout log entries into another user's SlotEntry by exploiting a missing ownership check. A crafted POST to /api/v2/workoutlog/ with the victim's SlotEntry ID is accepted and persisted, silently folding the injected data into the victim's progressive-overload calculations and corrupting auto-generated weight and repetition targets. This IDOR (CWE-639) is rated medium severity (CVSS 6.5, PR:L), with a public proof-of-concept in the advisory; version 2.6 contains the vendor patch. Exploitation is bounded to multi-user instances and affects only data integrity-no read access, code execution, or availability impact.
wger before 2.6 fails to revoke bearer-style API credentials on logout or password change, allowing an attacker who already holds a stolen DRF authtoken or JWT refresh token to continue accessing protected /api/v2/* endpoints. The assessed CVSS is 4.8 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting a moderate defense-in-depth authentication weakness rather than a high-urgency flaw. Publicly available exploit code exists in the form of proof-of-concept replay steps, but exploitation requires prior token theft and the vulnerability provides no means to obtain the token; active exploitation is not confirmed.
wger before 2.6 contains a CSRF bypass (CWE-352) that lets an attacker-controlled web page silently rebind an authenticated trainer's session to an arbitrary user account. Because the trainer_login view (wger/core/views/user.py, ~lines 161-210) accepts GET and calls django_login() directly, it falls outside Django's CsrfViewMiddleware enforcement, which only checks unsafe methods; a single <img> tag pointing at /en/user/<user_pk>/trainer-login forces the victim's browser to issue the request with the session cookie attached. Exploitation is authenticated (CVSS PR:L) and requires user interaction (UI:R) - the trainer must hold trainer privileges and be lured onto the malicious page - and, per the assessed vector, it depends on a non-trivial SameSite=Lax bypass via the view's ?next= 302 redirect chain, which raises attack complexity to AC:H and makes this a targeted rather than opportunistic or wormable issue. No CISA KEV listing or independent public exploit code was identified at time of analysis, though the vendor advisory documents a Playwright-verified reproduction in Chromium 147.
CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadsheet formulas into their own first_name or last_name profile fields, which are then reproduced verbatim in the TSV export file. When a gym administrator opens the exported file in Excel, LibreOffice Calc, or Google Sheets, the formula executes in the admin's local spreadsheet context, enabling data exfiltration via =HYPERLINK callbacks and, on legacy Excel deployments with DDE enabled, arbitrary local code execution. No public exploit code has been independently verified beyond the researcher's proof-of-concept described in the GHSA advisory; this vulnerability is not listed in the CISA KEV catalog.
Open redirect in wger's trainer_login view allows an attacker to redirect an authenticated trainer's browser to an arbitrary external domain immediately after impersonation mode is established. The root cause is in `wger/core/views/user.py` (~line 203), where `HttpResponseRedirect(request.GET['next'])` is called without invoking Django's `url_has_allowed_host_and_scheme()` guard, allowing any URL - including off-host ones - to be supplied via the `?next=` GET parameter. Beyond phishing, the redirect leaks the wger instance URL structure and the impersonated user's `user_pk` through the browser's Referer header; a working PoC is confirmed in the GHSA advisory, though no active exploitation has been reported.
Incomplete authorization fix in wger through master exposes three user-management views in wger/core/views/user.py to the same None != None gym-scope bypass previously identified in CVE-2026-43948 (GHSA-mhc8-p3jx-84mm). A gym staff member holding gym.manage_gym permission whose account has gym=None - the default unlinked state for any newly provisioned staff account - can permanently delete, deactivate, or re-activate any other user also carrying gym=None, exploiting a raw integer comparison that evaluates None != None as False instead of blocking the operation. No vendor-released patch has been identified at time of analysis; all wger versions through the master Docker image build of 2026-05-08 are confirmed affected.
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's password to be reset by tricking an authenticated trainer or admin into loading a malicious URL. The vulnerable `reset_user_password` view in `wger/gym/views/gym.py` performed its state-changing operation via HTTP GET, which Django's CSRF middleware does not protect by design. The upstream fix - commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 - converts the action to a POST-based confirmation form with full CSRF token enforcement; no public exploit and no CISA KEV listing have been identified at time of analysis.
Account-deactivation privilege escalation in wger before 2.6 lets an authenticated user who holds only the gym_trainer role disable higher-privileged accounts - including gym_manager and general_gym_manager - within the same gym, locking those users out of the application entirely. Access control on UserDeactivateView (and the mirror-image UserActivateView) uses OR logic across gym.manage_gym, gym.manage_gyms and gym.gym_trainer, with no privilege-hierarchy check and only a same-gym membership check in dispatch(), so the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - an insider/lower-privileged-role escalation, not a remote unauthenticated attack, and one that cannot cross gym boundaries. Publicly available exploit code exists (the vendor advisory itself publishes a working PoC of the GET request), but there is no confirmed active exploitation (CISA KEV) and no EPSS score was supplied in the intelligence feed; a gym manager provisioning a trainer account, which get_permission_list() always allows, is the amplifying path by which a trainer can then turn around and disable the manager who created it.
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded `date_sequence` while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. No public exploit code has been released independently, though the GHSA advisory itself contains a complete, weaponizable step-by-step PoC including exact API payloads.
Cross-user integrity corruption in wger versions prior to 2.6 allows authenticated attackers to inject arbitrary workout log entries into another user's SlotEntry by exploiting a missing ownership check. A crafted POST to /api/v2/workoutlog/ with the victim's SlotEntry ID is accepted and persisted, silently folding the injected data into the victim's progressive-overload calculations and corrupting auto-generated weight and repetition targets. This IDOR (CWE-639) is rated medium severity (CVSS 6.5, PR:L), with a public proof-of-concept in the advisory; version 2.6 contains the vendor patch. Exploitation is bounded to multi-user instances and affects only data integrity-no read access, code execution, or availability impact.
wger before 2.6 fails to revoke bearer-style API credentials on logout or password change, allowing an attacker who already holds a stolen DRF authtoken or JWT refresh token to continue accessing protected /api/v2/* endpoints. The assessed CVSS is 4.8 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting a moderate defense-in-depth authentication weakness rather than a high-urgency flaw. Publicly available exploit code exists in the form of proof-of-concept replay steps, but exploitation requires prior token theft and the vulnerability provides no means to obtain the token; active exploitation is not confirmed.
wger before 2.6 contains a CSRF bypass (CWE-352) that lets an attacker-controlled web page silently rebind an authenticated trainer's session to an arbitrary user account. Because the trainer_login view (wger/core/views/user.py, ~lines 161-210) accepts GET and calls django_login() directly, it falls outside Django's CsrfViewMiddleware enforcement, which only checks unsafe methods; a single <img> tag pointing at /en/user/<user_pk>/trainer-login forces the victim's browser to issue the request with the session cookie attached. Exploitation is authenticated (CVSS PR:L) and requires user interaction (UI:R) - the trainer must hold trainer privileges and be lured onto the malicious page - and, per the assessed vector, it depends on a non-trivial SameSite=Lax bypass via the view's ?next= 302 redirect chain, which raises attack complexity to AC:H and makes this a targeted rather than opportunistic or wormable issue. No CISA KEV listing or independent public exploit code was identified at time of analysis, though the vendor advisory documents a Playwright-verified reproduction in Chromium 147.
CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadsheet formulas into their own first_name or last_name profile fields, which are then reproduced verbatim in the TSV export file. When a gym administrator opens the exported file in Excel, LibreOffice Calc, or Google Sheets, the formula executes in the admin's local spreadsheet context, enabling data exfiltration via =HYPERLINK callbacks and, on legacy Excel deployments with DDE enabled, arbitrary local code execution. No public exploit code has been independently verified beyond the researcher's proof-of-concept described in the GHSA advisory; this vulnerability is not listed in the CISA KEV catalog.
Open redirect in wger's trainer_login view allows an attacker to redirect an authenticated trainer's browser to an arbitrary external domain immediately after impersonation mode is established. The root cause is in `wger/core/views/user.py` (~line 203), where `HttpResponseRedirect(request.GET['next'])` is called without invoking Django's `url_has_allowed_host_and_scheme()` guard, allowing any URL - including off-host ones - to be supplied via the `?next=` GET parameter. Beyond phishing, the redirect leaks the wger instance URL structure and the impersonated user's `user_pk` through the browser's Referer header; a working PoC is confirmed in the GHSA advisory, though no active exploitation has been reported.
Incomplete authorization fix in wger through master exposes three user-management views in wger/core/views/user.py to the same None != None gym-scope bypass previously identified in CVE-2026-43948 (GHSA-mhc8-p3jx-84mm). A gym staff member holding gym.manage_gym permission whose account has gym=None - the default unlinked state for any newly provisioned staff account - can permanently delete, deactivate, or re-activate any other user also carrying gym=None, exploiting a raw integer comparison that evaluates None != None as False instead of blocking the operation. No vendor-released patch has been identified at time of analysis; all wger versions through the master Docker image build of 2026-05-08 are confirmed affected.
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's password to be reset by tricking an authenticated trainer or admin into loading a malicious URL. The vulnerable `reset_user_password` view in `wger/gym/views/gym.py` performed its state-changing operation via HTTP GET, which Django's CSRF middleware does not protect by design. The upstream fix - commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 - converts the action to a POST-based confirmation form with full CSRF token enforcement; no public exploit and no CISA KEV listing have been identified at time of analysis.