CVE-2026-40474

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-40474

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40474.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-40474

Aliases

Published

2026-04-17T21:39:03.677Z

Modified

2026-08-07T11:51:02.345422521Z

Severity

7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L CVSS Calculator

Summary

wger has Broken Access Control in the Global Gym Configuration Update Endpoint

Details

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permissionrequired = 'config.changegymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced at runtime. Since GymConfig is an ownerless singleton, any authenticated user can modify the global gym configuration, triggering save() side effects that bulk-update user profile gym assignments — a vertical privilege escalation to installation-wide configuration control. This issue is fixed in version 2.5.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40474.json"
}

References

Affected packages

Git / github.com/wger-project/wger

Affected ranges

Type

GIT

Repo

https://github.com/wger-project/wger

Events

Introduced

Fixed

c1fca6bdf77d8ed80048d1b73a8da80cf36ee751

Fixed

47ee5af93b3ced24b9f94b0a8b9296b50bc9523f

Database specific

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5"
        }
    ]
}

Affected versions

1.*

1.0

1.0.1

1.0.2

1.0.3

1.1

1.2

1.3

1.4

1.5

1.7

1.8

1.9

2.*

2.0

2.3

2.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40474.json"