CVEvulnerability

CVE-2026-40474

7.6 HIGH Published 2026-04-17 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-04-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Weaknesses
CWE-284, CWE-862

Description

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced at runtime. Since GymConfig is an ownerless singleton, any authenticated user can modify the global gym configuration, triggering save() side effects that bulk-update user profile gym assignments — a vertical privilege escalation to installation-wide configuration control. This issue is fixed in version 2.5.

Affected configurations

• wger wger (< 2.5)

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-862 Missing Authorization weakness

References