SB20260511110 - Multiple vulnerabilities in wger

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260511110

SB20260511110 - Multiple vulnerabilities in wger

Published: May 11, 2026 Updated: October 5, 2026

Security Bulletin ID SB20260511110
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 43% Low 57%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2026-86255)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in RoutineSerializer function. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.


2) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-43977)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the RoutineViewSet /logs/ and /stats/ API actions when handling requests for template routines not owned by the requester. A remote attacker can send crafted requests to read another user's private workout session notes, exercise history, and training statistics.

Exploitation is possible against routines marked as public templates, and routine IDs can be enumerated via the routine listing endpoint.


3) Improper privilege management (CVE-ID: CVE-2026-43978)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges and impersonate a gym manager or general manager account.

The vulnerability exists due to improper privilege management in the trainer-login endpoint in wger/core/views/user.py when processing chained trainer-login requests. A remote user can perform a legitimate switch into a low-privileged user and then send a subsequent trainer-login request to impersonate a higher-privileged account to escalate privileges and impersonate a gym manager or general manager account.

Exploitation requires access to a gym trainer account and a target manager account within the same gym.


4) Improper privilege management (CVE-ID: CVE-2026-46434)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to deactivate higher-privileged accounts.

The vulnerability exists due to improper privilege management in UserDeactivateView and UserActivateView when handling account activation and deactivation requests. A remote user can send a request targeting a higher-privileged account in the same gym to deactivate it.

Exploitation requires a gym_trainer permission and membership in the same gym as the target account.


5) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-46438)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to corrupt other users' training data.

The vulnerability exists due to missing authorization in WorkoutLogViewSet when processing POST requests to the /api/v2/workoutlog/ endpoint. A remote user can submit a workout log containing a victim's slot_entry identifier to corrupt other users' training data.

Exploitation requires a victim SlotEntry identifier and a routine owned by the user.


6) Cross-site request forgery (CVE-ID: CVE-2026-45161)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to forcibly rebind an authenticated trainer's session to an arbitrary user account.

The vulnerability exists due to cross-site request forgery in the trainer_login view when handling GET requests. A remote user can cause an authenticated trainer to load a malicious page containing a crafted image request to rebind the session.

User interaction is required to load the malicious page.


7) Incorrect authorization (CVE-ID: CVE-2026-43976)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose private administrative notes, uploaded documents, gym contracts, user configuration data, and user permission data for other unaffiliated users.

The vulnerability exists due to incorrect authorization in the gym management views when handling requests for a user whose gym assignment is unset. A remote user can request affected endpoints with an attacker-supplied member identifier to disclose private user data.

Exploitation requires the gym.gym_trainer and gym.add_adminusernote permissions, and both the requester and target user must have no gym assignment.


Remediation

Install update from vendor's website.

References