CVE-2026-86256

In wger prior to version 2.6, there is a vulnerability that allows a user with gym.manage_gym permissions to reset the password of any user with no gym assignment. By exploiting an object comparison error, an attacker can take over the victim's account, and the victim's original password is invalidated.

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user with gym=None. Attackers with gym.manage_gym permission and gym=None affiliation can permanently delete user accounts, lock users out via deactivation, or undo defensive deactivations by exploiting the None != None comparison edge case.

A flaw was found in wger-project wger up to 2.6.0-alpha2 in the function reset_user_password of the file wger/gym/views/gym.py in the Password Reset component. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. A patch is recommended.

In wger prior to version 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. After a legitimate switch to a low-privileged user, the session flag `trainer.identity` is set and bypasses permission checks on subsequent trainer-login calls.

In wger versions prior to 2.6, an authenticated user can read another user's private workout notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability is due to incorrect permission checks in RoutineViewSet, which grants read access to any authenticated user when the routine has is_template=True.