Wger-project vulnerabilities
We track 6 vulnerabilities in Wger-project products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 7, 2026.
Latest Wger-project vulnerabilities
- 7.1 High severity
wger: Improper Privilege Management
wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants
- 7.1 High severity
wger: Incorrect Authorization
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add
- 8.1 High severity
wger: Improper Privilege Management
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer perf
- 7.5 High severity
wger: Authorization Bypass Through User-Controlled Key
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine th
- 9.9 Critical severity
wger: Incorrect Authorization
wger is a free, open-source workout and fitness manager. Prior to 2.6, the reset_user_password and gym_permissions_user_edit views in wger perform a gym-scope authorization check using Python object comparison (!=) that evaluates None != None as False, silentl
- 7.6 High severity
wger: Improper Access Control
wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced