PT-2026-33301 · Wger · Wger

Published 2026-04-16 · Updated 2026-04-18 · CVE-2026-40474

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.5

Description An improper access control issue exists in the GymConfigUpdateView component. The view declares a required permission config.change gymconfig but fails to enforce it at runtime because it inherits WgerFormMixin instead of WgerPermissionMixin. Since the GymConfig object is an ownerless singleton and does not implement the get owner object() function, ownership checks are skipped.

This allows any authenticated user to access the endpoint '/config/gym-config/edit' and modify the global gym configuration. Such modifications trigger side effects in the save() function that bulk-update user profile gym assignments, resulting in a vertical privilege escalation to installation-wide configuration control.

Recommendations Update to version 2.5. As a temporary workaround, restrict access to the '/config/gym-config/edit' endpoint to authorized administrators only.

Fix

LPE

Missing Authorization

Improper Access Control

Weakness Enumeration

CWE-862

CWE-284

Related Identifiers

CVE-2026-40474

GHSA-XPPV-4JRX-QF8M

Affected Products

Wger

References · 9

• https://github.com/wger-project/wger/commit/47ee5af93b3ced24b9f94b0a8b9296b50bc9523f · Patch
• https://github.com/wger-project/wger/security/advisories/GHSA-xppv-4jrx-qf8m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40474 · Security Note
• https://osv.dev/vulnerability/GHSA-xppv-4jrx-qf8m · Vendor Advisory
• https://github.com/wger-project/wger · Note
• https://github.com/wger-project/wger/releases/tag/2.5 · Note
• https://twitter.com/VulmonFeeds/status/2045383477499920774 · Twitter Post
• https://twitter.com/CVEnew/status/2045467378079629523 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1sn0wwt/resumen_diario_de_vulnerabilidades_16042026 · Reddit Post