wger-project vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 202618

Newest CVEs

• CVE-2026-46438

  wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

  wger-project · wger

  Medium6.5
• CVE-2026-46437

  wger: API credentials remain valid after logout/password change

  wger-project · wger

  Medium4.8
• CVE-2026-46434

  wger: Trainer Privilege Escalation - Improper Privilege Management

  wger-project · wger

  High7.1
• CVE-2026-45161

  wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

  wger-project · wger

  Medium5.4
• CVE-2026-43976

  wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

  wger-project · wger

  High7.1
• CVE-2026-86257

  wger before 2.6 CSV Formula Injection via member export

  wger-project · wger

  Medium4.8
• CVE-2026-86256

  wger before 2.6 Open Redirect via trainer-login next parameter

  wger-project · wger

  Medium5.1
• CVE-2026-86255

  wger before 2.5 Uncontrolled Resource Consumption via date_sequence

  wger-project · wger

  High7.1
• CVE-2026-86254

  wger Incomplete Authorization Fix Cross-Tenant Account Deletion

  wger-project · wger

  Medium6.1
• CVE-2026-82544

  wger-project wger Password Reset gym.py reset_user_password cross-site request forgery

  wger-project · wger

  Medium5.3