CVE-2026-82544
Received Received - Intake

Cross-Site Request Forgery in wger Project

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulDB

Description
A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This patch is called 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314. It is advisable to implement a patch to correct this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82544
EUVD
EUVD-2026-68219

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wger-project wger to 2.6.0-alpha2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the wger fitness application up to version 2.6.0-alpha2. It affects the password reset function in the gym.py file, allowing attackers to manipulate users into triggering state changes like password resets via malicious GET requests. Since Django's CSRF protection does not cover GET requests, authenticated users could unknowingly execute these actions by visiting a crafted link.

Detection Guidance

To detect this vulnerability, check if the wger application version is up to 2.6.0-alpha2 or earlier. Inspect the password reset functionality in wger/gym/views/gym.py for the reset_user_password function. Verify if GET requests can trigger state changes like password resets or account deactivation without POST requests.

Impact Analysis

An attacker could trick you into resetting your password or deactivating your account by sending a malicious link. This could lock you out of your account or expose your new password. The attack requires you to be authenticated and have sufficient permissions, such as being a gym manager or trainer.

Compliance Impact

This vulnerability could lead to unauthorized account deactivation or password resets, potentially violating data access and integrity requirements under GDPR and HIPAA. Unauthorized state changes may result in non-compliance with user consent and security controls mandated by these regulations.

Mitigation Strategies

Apply the patch from commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314. Ensure all state-changing actions like password resets and account deactivation require POST requests. Review UserActivateView and UserDeactivateView for similar issues. Update to the latest version of wger.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82544. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart