CVE-2026-43948 - Vulnerability Analysis

Overview

wger < 2.6 contains a broken access control caused by improper gym-scope authorization check using Python object comparison in reset_user_password and gym_permissions_user_edit views, letting users with gym.manage_gym permission and gym=None reset passwords of other gym=None users and obtain plaintext passwords, exploit requires gym.manage_gym permission and gym=None.

Severity & Score

Impact

Attackers can fully take over accounts of users with no gym assignment by resetting passwords and obtaining plaintext passwords.

Mitigation

Update to version 2.6 or later.

References

• https://github.com/wger-project/wger/security/advisories/GHSA-mhc8-p3jx-84mm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner