SB20260420113 - Multiple vulnerabilities in wger

Description

This security bulletin contains information about 2 vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2026-40474)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to modify installation-wide configuration and other users' records.

The vulnerability exists due to missing authorization in the GymConfigUpdateView endpoint at /config/gym-config/edit when handling authenticated configuration update requests. A remote user can submit a specially crafted request to modify installation-wide configuration and other users' records.

The affected object is a singleton GymConfig instance, and saving changes can trigger installation-wide side effects including bulk updates to user profile gym assignments.

2) Cross-site scripting (CVE-ID: CVE-2026-40353)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear

The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in the AbstractLicenseModel.attribution_link property and ingredient view template when rendering user-controlled license attribution fields. A remote user can create an ingredient with a specially crafted license_author value to execute arbitrary script in a victim's browser.

The malicious content is stored in the database and is triggered when any user, including unauthenticated visitors, views the public ingredient page.

Remediation

Install update from vendor's website.

References

• https://github.com/wger-project/wger/security/advisories/GHSA-xppv-4jrx-qf8m
• https://github.com/advisories/GHSA-xppv-4jrx-qf8m
• https://github.com/wger-project/wger/security/advisories/GHSA-6f54-qjvm-wwq3
• https://github.com/advisories/GHSA-6f54-qjvm-wwq3