Authorization Bypass in wger Workout and Fitness Manager
CVE-2026-43948
What is CVE-2026-43948?
The wger Workout and Fitness Manager is subject to an authorization bypass vulnerability. Prior to version 2.6, the application lacks sufficient validation within the reset_user_password and gym_permissions_user_edit views. This flaw arises due to an incorrect gym-scope authorization check that makes object comparison using Python's '!=' operator, which evaluates None as False when both the attacker and target user have no assigned gym. A malicious user with gym.manage_gym permission can exploit this to reset the password for any other user without gym assignment. The new password will be displayed in plaintext within the HTML response, enabling a simple account takeover while rendering the affected user's original password invalid, effectively locking them out permanently. This critical vulnerability is addressed in version 2.6.
Affected Version(s)
wger < 2.6