CVE-2026-40474
wger has Broken Access Control in the Global Gym Configuration Update Endpoint
CVSS Score
7.6
EPSS Score
0.0%
EPSS Percentile
0th
wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced at runtime. Since GymConfig is an ownerless singleton, any authenticated user can modify the global gym configuration, triggering save() side effects that bulk-update user profile gym assignments — a vertical privilege escalation to installation-wide configuration control. This issue is fixed in version 2.5.
| CWE | CWE-284 CWE-862 |
| Vendor | wger-project |
| Product | wger |
| Published | Apr 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for wger-project wger
Be the first to know when new high vulnerabilities affecting wger-project wger are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
Low
Affected Versions
wger-project / wger
< 2.5