Read the docs
TI-2026-69139 Aliases CVE-2026-45161GHSA-xf64-4pmc-h8qf

Cross-site request forgery in wger lets attackers rebind sessions

Priority LOW 23CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

wger before 2.6 is affected, as is the wger PyPI package through 2.1. The trainer_login view accepts GET requests, so Django's CSRF protection, which checks only unsafe methods, does not cover it (CWE-352). An attacker who lures an authenticated trainer to a malicious page can force the trainer's session to be rebound to an arbitrary user account.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login()` without any CSRF protection, because Django's `CsrfViewMiddleware` only enforces tokens on unsafe methods (POST/PUT/PATCH/DELETE). An attacker can embed a single `<img>` tag on a malicious page; when an authenticated trainer loads that page, their browser auto-issues the GET with the session cookie, forcibly rebinding the trainer's session to an arbitrary user account. Version 2.6 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00088 0th percentileScored 2026-11-07
Fix Fixed wger (wger-project): 2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wger-projectwgerbefore 2.62.6Patch availableCNA
—wger (PyPI)up to 2.1—No fix listedGHSA-xf64-4pmc-h8qf
  • wger Vendorwger-project Affected before 2.6 Fixed in 2.6 Patch available CNA
  • wger (PyPI) Vendor— Affected up to 2.1 Fixed in — No fix listed GHSA-xf64-4pmc-h8qf

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:*——wger-project
  • cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* Versions — — ·wger-project

Remediation

Upgrade wger to version 2.6, which fixes the issue. The sources list no fixed version for wger.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA wger (wger-project) Fixed in 2.6

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-45161
  2. 2026-10-07 Alias added: GHSA-xf64-4pmc-h8qf
  3. 2026-10-07 Affected versions changed · GHSA-xf64-4pmc-h8qf
  4. 2026-10-07 CVSS score added · GHSA-xf64-4pmc-h8qf
  5. 2026-10-07 Weakness changed · GHSA-xf64-4pmc-h8qf
  6. 2026-10-07 3 new references · GHSA-xf64-4pmc-h8qf
  7. 2026-10-07 CISA SSVC decision points changed
  8. 2026-10-07 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-32005 wger: cross-tenant password reset and plaintext disclosure via gym=None bypass CVSS 3.1CRITICAL 9.9
  • TI-2022-02450 Improper Restriction of Excessive Authentication Attempts in wger-project/wger CVSS 3.1CRITICAL 9.8
  • TI-2023-20093 Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager… CVSS 3.1HIGH 8.8
  • TI-2026-32021 wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API CVSS 3.1HIGH 7.5
  • TI-2026-32022 wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers CVSS 3.1HIGH 8.1
  • TI-2026-29226 wger has Broken Access Control in the Global Gym Configuration Update Endpoint CVSS 3.1HIGH 7.6
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences