Wger-project Wger vulnerabilities

• wger-project wger wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry CVE-2026-46438 6.5 MediumOctober 7, 2026
• wger-project wger wger: API credentials remain valid after logout/password change CVE-2026-46437 4.8 MediumOctober 7, 2026
• wger-project wger wger: Trainer Privilege Escalation - Improper Privilege Management CVE-2026-46434 7.1 HighOctober 7, 2026
• wger-project wger wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding CVE-2026-45161 5.4 MediumOctober 7, 2026
• wger-project wger wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views) CVE-2026-43976 7.1 HighOctober 7, 2026
• wger-project wger wger Incomplete Authorization Fix Cross-Tenant Account Deletion CVE-2026-86254 6.1 MediumSeptember 6, 2026
• wger-project wger wger-project wger Password Reset gym.py reset_user_password cross-site request forgery CVE-2026-82544 5.3 MediumAugust 30, 2026
• wger-project wger wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers CVE-2026-43978 8.1 HighMay 14, 2026
• wger-project wger wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API CVE-2026-43977 7.5 HighMay 14, 2026
• wger-project wger wger before 2.5 Uncontrolled Resource Consumption via date_sequence CVE-2026-86255 7.1 HighMay 13, 2026
• wger-project wger wger before 2.6 Open Redirect via trainer-login next parameter CVE-2026-86256 Fix available 5.1 MediumMay 6, 2026
• wger-project wger wger: cross-tenant password reset and plaintext disclosure via gym=None bypass CVE-2026-43948 Fix available 9.9 CriticalMay 6, 2026
• wger-project wger wger before 2.6 CSV Formula Injection via member export CVE-2026-86257 Fix available 4.8 MediumMay 6, 2026
• wger wger: Stored XSS via Unescaped License Attribution Fields CVE-2026-40353 5.1 MediumApril 16, 2026
• wger wger has Broken Access Control in the Global Gym Configuration Update Endpoint CVE-2026-40474 7.6 HighApril 16, 2026
• wger wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup CVE-2026-27839 4.3 MediumFebruary 26, 2026
• wger wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data CVE-2026-27838 3.1 LowFebruary 26, 2026
• wger wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data CVE-2026-27835 4.3 MediumFebruary 26, 2026
• wger, wger-project wger-project/wger +1 more Improper Restriction of Excessive Authentication Attempts in wger-project/wger CVE-2022-2650 Public exploitFix available 7.8 HighNovember 24, 2022