Vulnerabilities

TI-2026-69147 CVE-2026-46438 · GHSA-rjpf-7pf5-q54x

wger missing ownership check lets users inject logs into others' slot entries

MEDIUM 62

wger is a free, open-source workout and fitness manager.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00227 Published 2026-10-07 Fixed in 2.6 CWE-639

TI-2026-69146 CVE-2026-46437 · GHSA-v3x9-6gg8-c2c9

API credentials stay valid after logout or password change in wger

MEDIUM 55

wger is a free, open-source workout and fitness manager.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00242 Published 2026-10-07 Fixed in 2.6 CWE-287

TI-2026-69145 CVE-2026-46434 · GHSA-x249-cx55-2h87

wger: Trainer Privilege Escalation through Improper Privilege Management

MEDIUM 64

wger is a free, open-source workout and fitness manager.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00221 Published 2026-10-07 Fixed in 2.6 CWE-269

TI-2026-69139 CVE-2026-45161 · GHSA-xf64-4pmc-h8qf

Cross-site request forgery in wger lets attackers rebind sessions

LOW 23

wger is a free, open-source workout and fitness manager.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00088 Published 2026-10-07 Fixed in 2.6 CWE-352

TI-2026-69138 CVE-2026-43976 · GHSA-c72h-82w6-rqfp

wger gym views leak other users' admin notes and contracts

MEDIUM 64

wger is a free, open-source workout and fitness manager.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00219 Published 2026-10-07 Fixed in 2.6 CWE-863

TI-2026-59043 CVE-2026-86257 · GHSA-pmr9-wpc3-f495

wger before 2.6 CSV Formula Injection via member export

MEDIUM 55

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00277 Published 2026-09-06 Fixed in 2.6 CWE-1236

TI-2026-59042 CVE-2026-86256 · GHSA-rc6j-63fm-mhq4

wger before 2.6 Open Redirect via trainer-login next parameter

MEDIUM 56

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py).

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00234 Published 2026-09-06 Fixed in 2.6 CWE-601

TI-2026-59041 CVE-2026-86255 · GHSA-vh7q-hj8h-q34m

wger before 2.5 Uncontrolled Resource Consumption via date_sequence

LOW 32

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00436 Published 2026-09-06 Fixed in 2.5 CWE-400

TI-2026-59040 CVE-2026-86254 · GHSA-qc8h-h7c3-v2gh

wger Incomplete Authorization Fix Cross-Tenant Account Deletion

MEDIUM 60

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper, a…

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.0037 Published 2026-09-06 No fix listed CWE-862

TI-2026-56901 CVE-2026-82544 · GHSA-frcw-fw5q-gh4g

wger-project wger Password Reset gym.py reset_user_password cross-site request forgery

LOW 24

A flaw has been found in wger-project wger up to 2.6.0-alpha2.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00241 Published 2026-08-30 No fix listed CWE-352

TI-2026-32021 CVE-2026-43977 · GHSA-cj9g-27ph-4cgv

wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API

HIGH 72

wger is a free, open-source workout and fitness manager.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00289 Published 2026-07-16 Fixed in 2.6 CWE-639

TI-2026-32022 CVE-2026-43978 · GHSA-9qpr-vc49-hqg2

wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers

HIGH 70

wger is a free, open-source workout and fitness manager.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00265 Published 2026-07-16 Fixed in 2.6 CWE-269

TI-2026-32005 CVE-2026-43948 · GHSA-mhc8-p3jx-84mm

wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

HIGH 76

wger is a free, open-source workout and fitness manager.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00371 Published 2026-05-12 Fixed in 2.6 CWE-863

TI-2026-29226 CVE-2026-40474 · GHSA-xppv-4jrx-qf8m

wger has Broken Access Control in the Global Gym Configuration Update Endpoint

HIGH 66

wger is a free, open-source workout and fitness manager.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00333 Published 2026-04-17 Fixed in 2.5 CWE-284

TI-2026-29128 CVE-2026-40353 · GHSA-6f54-qjvm-wwq3

wger: Stored XSS via Unescaped License Attribution Fields

MEDIUM 56

wger is a free, open-source workout and fitness manager.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00207 Published 2026-04-17 Fixed in 2.5 CWE-79

TI-2026-22190 CVE-2026-27839 · GHSA-g8gc-6c4h-jg86

wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup

MEDIUM 53

wger is a free, open-source workout and fitness manager.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00304 Published 2026-02-26 No fix listed CWE-639

TI-2026-22189 CVE-2026-27838 · GHSA-42cr-w2gr-m54q

wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data

MEDIUM 50

wger is a free, open-source workout and fitness manager.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00294 Published 2026-02-26 No fix listed CWE-639

TI-2026-22186 CVE-2026-27835 · GHSA-xf68-8hjw-7mpm

wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data

MEDIUM 53

wger is a free, open-source workout and fitness manager.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00295 Published 2026-02-26 No fix listed CWE-639

TI-2023-20093 CVE-2023-38759 · GHSA-wrw3-qmqw-4x9w

Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager…

HIGH 73

Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/reset_user_p…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00398 Published 2023-08-08 No fix listed CWE-352

TI-2023-20092 CVE-2023-38758 · GHSA-8m9p-3926-gffr

Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows…

MEDIUM 58

Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function in the templates/ingredients/view.…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00581 Published 2023-08-08 No fix listed CWE-79

TI-2022-02450 CVE-2022-2650 · GHSA-gr58-76rp-mmg4

Improper Restriction of Excessive Authentication Attempts in wger-project/wger

HIGH 76

Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00738 Published 2022-11-24 Fixed in 2.2 CWE-307

Vulnerabilities

Filters