PT-2026-38284 · Wger · Wger

Published 2026-05-06 · Updated 2026-05-13 · CVE-2026-43948

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6

Description An authorization bypass exists in the reset user password and gym permissions user edit views. The system performs a gym-scope authorization check using a Python object comparison that evaluates None != None as False. This allows a user with gym.manage gym permission and no gym assignment (gym=None) to bypass the security guard and reset the password of any other user who also has no gym assignment. The new plaintext password is returned in the HTML response body, enabling full account takeover and permanently locking the victim out of their account.

Technical details include the following affected endpoints:

• '/en/gym/user//reset-user-password'
• '/en/gym/user//edit'

Recommendations Update to version 2.6. As a temporary workaround, restrict the gym.manage gym permission to trusted administrators only.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-43948

GHSA-MHC8-P3JX-84MM

Affected Products

Wger

References · 8

• 🔥 https://github.com/wger-project/wger/security/advisories/GHSA-mhc8-p3jx-84mm · Exploit
• https://osv.dev/vulnerability/GHSA-mhc8-p3jx-84mm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43948 · Security Note
• https://github.com/wger-project/wger · Note
• https://twitter.com/VulmonFeeds/status/2054450615829279140 · Twitter Post
• https://t.me/CVEtracker/53549 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1tbxqow/critical_auth_bypass_in_wger_exposes_user_accounts · Reddit Post
• https://twitter.com/CVEnew/status/2054324007760220515 · Twitter Post