Stored XSS in GYM One Admin User List

Executive Summary

CVE-2026-55872 is a Stored Cross-Site Scripting (XSS) vulnerability in GYM One, an open-source gym management system. It occurs because user profile fields (firstname, lastname, email) are rendered in the admin user list without HTML encoding. An attacker with low privileges can inject malicious scripts into these fields, which execute when an administrator views the user list.

Useful 0 Not Useful 0

Detection Guidance

Check if your GYM One instance is running a version prior to 1.4.1. Inspect the admin/users/index.php file for direct rendering of user profile fields without output encoding. Manually test by injecting a harmless script like <script>alert(1)</script> into the firstname, lastname, or email fields and verify if it executes when viewing the admin user list.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to steal administrator session cookies, capture credentials via fake login forms, or perform actions with admin privileges. The attack persists until the malicious user record is deleted. It requires low privileges and user interaction but can lead to full account compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to personal data through session hijacking or credential theft. For HIPAA, it may compromise protected health information if admin accounts with access to such data are compromised. Both standards require protecting user data confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade GYM One to version 1.4.1 or later immediately. If upgrading is not possible, apply output encoding to firstname, lastname, and email fields in admin/users/index.php by wrapping them with htmlspecialchars() before rendering. Remove any suspicious user profiles that may contain malicious scripts.

Useful 0 Not Useful 0