WG
Product
wger
18
CVEs
0
On KEV
9.9
Max CVSS
5
New 30D
Severity mix
Critical 1High 5Medium 11Low 1
Watch
Add wger to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-43948 | 9.9 | May 12 | wger: cross-tenant password reset and plaintext disclosure via gym=None bypass Affected: < 2.6 |
| CVE-2026-43978 | 8.1 | Jul 16 | wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers Affected: < 2.6 |
| CVE-2026-40474 | 7.6 | Apr 17 | wger has Broken Access Control in the Global Gym Configuration Update Endpoint Affected: < 2.5 |
| CVE-2026-43977 | 7.5 | Jul 16 | wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API Affected: < 2.6 |
| CVE-2026-46434 | 7.1 | Oct 7 | wger: Trainer Privilege Escalation - Improper Privilege Management Affected: < 2.6 |
| CVE-2026-43976 | 7.1 | Oct 7 | wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views) Affected: < 2.6 |
| CVE-2026-86254 | 6.8 | Sep 6 | wger Incomplete Authorization Fix Cross-Tenant Account Deletion Affected: through master |
| CVE-2026-46438 | 6.5 | Oct 7 | wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry Affected: < 2.6 |
| CVE-2026-86255 | 6.5 | Sep 6 | wger before 2.5 Uncontrolled Resource Consumption via date_sequence Affected: before 2.5 |
| CVE-2026-45161 | 5.4 | Oct 7 | wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding Affected: < 2.6 |
| CVE-2026-86257 | 5.4 | Sep 6 | wger before 2.6 CSV Formula Injection via member export Affected: before 2.6 |
| CVE-2026-86256 | 5.4 | Sep 6 | wger before 2.6 Open Redirect via trainer-login next parameter Affected: before 2.6 |
| CVE-2026-40353 | 5.4 | Apr 17 | wger: Stored XSS via Unescaped License Attribution Fields Affected: < 2.5 |
| CVE-2026-46437 | 4.8 | Oct 7 | wger: API credentials remain valid after logout/password change Affected: < 2.6 |
| CVE-2026-82544 | 4.3 | Aug 30 | wger-project wger Password Reset gym.py reset_user_password cross-site request forgery Affected: 2.6.0-alpha2 |
| CVE-2026-27839 | 4.3 | Feb 26 | wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup Affected: <= 2.4 |
| CVE-2026-27835 | 4.3 | Feb 26 | wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data Affected: <= 2.4 |
| CVE-2026-27838 | 3.5 | Feb 26 | wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data Affected: <= 2.4 |
Showing 18