Wger-Project Wger
13 CVEs affecting Wger-Project Wger. Latest disclosed: 2026-09-06. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-43948 | Critical | 9.9 | 2026-05-12 | wger is a free, open-source workout and fitness manager. Prior to 2.6, the reset_user_password and gym_permissions_user_edit views in wger perform a gym-scope… |
CVE-2026-43978 | High | 8.1 | 2026-07-16 | wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (g… |
CVE-2026-40474 | High | 7.6 | 2026-04-17 | wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymco… |
CVE-2026-43977 | High | 7.5 | 2026-07-16 | wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes… |
CVE-2026-86254 | Medium | 6.8 | 2026-09-06 | wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using… |
CVE-2026-86255 | Medium | 6.5 | 2026-09-06 | wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long period… |
CVE-2026-86257 | Medium | 5.4 | 2026-09-06 | wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas… |
CVE-2026-86256 | Medium | 5.4 | 2026-09-06 | wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enter… |
CVE-2026-40353 | Medium | 5.4 | 2026-04-17 | wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by di… |
CVE-2026-82544 | Medium | 4.3 | 2026-08-30 | A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the com… |
CVE-2026-27839 | Medium | 4.3 | 2026-02-26 | wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Mo… |
CVE-2026-27835 | Medium | 4.3 | 2026-02-26 | wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` retu… |
CVE-2026-27838 | Low | 3.1 | 2026-02-26 | wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up… |