CVE-2026-43948
CriticalSummary
In wger prior to version 2.6, there is a vulnerability that allows a user with gym.manage_gym permissions to reset the password of any user with no gym assignment. By exploiting an object comparison error, an attacker can take over the victim's account, and the victim's original password is invalidated.
Risk Assessment
The organization is at risk of user account takeover, which can lead to data loss and access to sensitive information. Attackers can lock victims out, preventing them from accessing their accounts.
Recommendation
It is recommended to update wger to version 2.6 or later to eliminate this vulnerability. Additionally, conduct a user permissions audit to minimize the risk of unauthorized access.
Original NVD description (English source)
wger is a free, open-source workout and fitness manager. Prior to 2.6, the reset_user_password and gym_permissions_user_edit views in wger perform a gym-scope authorization check using Python object comparison (!=) that evaluates None != None as False, silently bypassing the guard when both the attacker and victim have no gym assignment (gym=None). A user with gym.manage_gym permission and gym=None can reset the password of any other gym=None user; the new plaintext password is returned verbatim in the HTML response body, enabling one-shot full account takeover. The victim's original password is invalidated, locking them out permanently. This vulnerability is fixed in 2.6.