These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
An authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slot_entry ID in a POST /api/v2/workoutlog/ request. This issue exists because the slot_entry foreign key is not included in the ownership verification performed by WorkoutLogViewSet.get_owner_objects(). The vulnerability allows for cross-user data corruption, potentially impacting [truncated]
A vulnerability in wger allows a user with the `gym_trainer` permission to deactivate any account in the same gym, including higher-privileged roles like `gym_manager` and `general_gym_manager`. This is due to the `UserDeactivateView` permitting access with any one of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` permissions without proper privilege hierarchy checks.
A vulnerability exists in the authentication/session lifecycle of `wger` where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken or JWT refresh token can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted or naturally expires.
The CVE-2026-45161 vulnerability in wger, a free, open-source workout and fitness manager, allows an attacker to bypass CSRF protection on the `trainer_login` view by accepting GET requests. This enables forced session rebinding, potentially allowing an attacker to bind a trainer's session to an arbitrary user account. The issue is fixed in version 2.6.
A vulnerability in wger, a free, open-source workout and fitness manager, allows trainers with specific permissions and no gym assignment to read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for other unaffiliated users. This issue, fixed in version 2.6, highlights the importance of proper gym-scope guard implementation to prevent cross-tenant data leaks.
CVE-2026-86257 is a medium-severity vulnerability in wger before version 2.6, which allows gym members to inject spreadsheet formulas into the TSV export endpoint, potentially leading to admin data exfiltration or code execution when the exported file is opened in spreadsheet software. The vulnerability exists due to improper sanitization of first_name and last_name fields in the gym member TSV export end [truncated]
CVE-2026-86254 debrief: Incomplete authorization in wger allows gym staff to delete, deactivate, or activate other users. This vulnerability exists in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper. Attackers with gym.manage_gym permission and gym=None affiliation can exploit this vulnerability to permanently d [truncated]
A flaw in wger-project wger up to 2.6.0-alpha2 allows for cross-site request forgery attacks via the reset_user_password function in wger/gym/views/gym.py. This issue can be exploited remotely, and users should apply the patch to prevent such attacks. The CVE record was published on 2026-08-30T14:17:02.627Z and has not been modified since then. The affected product is wger-project wger up to 2.6.0-alpha2. [truncated]
A vulnerability in wger, a free, open-source workout and fitness manager, allows a gym trainer to escalate their session to any higher-privileged account by chaining two calls to the trainer-login endpoint. This grants full gym administration capabilities. The vulnerability has been fixed in version 2.6. Users of wger versions prior to 2.6, particularly gym administrators and trainers, should be aware of [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-16T23:16:16.167Z and has not been modified since then. The vulnerability exists in wger Workout and Fitness Manager versions prior to 2.6, allowing any authenticated user to read another user's private workout session notes, exercise history, and training statistics. This issue has been fixed in ver [truncated]
