CVE-2026-40474

Katalog CVE

CVSS 7.6 · High EPSS 0,40%

Kerentanan Improper Access Control pada wger. Skor CVSS 3.1 7.6 (High) menurut github.com.

Deskripsi (NVD)

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced at runtime. Since GymConfig is an ownerless singleton, any authenticated user can modify the global gym configuration, triggering save() side effects that bulk-update user profile gym assignments — a vertical privilege escalation to installation-wide configuration control. This issue is fixed in version 2.5.

Rincian

Terbit di NVD

17 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.6 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-862: Missing Authorization

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wger-project/wger/security/advisories/GHSA-xppv-4jrx-qf8m exploit · advisory vendor
• https://github.com/wger-project/wger/commit/47ee5af93b3ced24b9f94b0a8b9296b50bc9523f patch
• https://github.com/wger-project/wger/releases/tag/2.5 release notes