CVE-2026-43948: wger Incorrect Authorization in Password Reset Views Enables Account Takeover
wger, a free open-source workout and fitness manager, has an Incorrect Authorization flaw (CWE-863) in its reset_user_password and gym_permissions_user_edit views. A gym-scope check using the != operator evaluates None != None as False, so the check is skipped for users without a gym assignment. The record describes this as enabling one-shot account takeover, and the issue is fixed in version 2.6.
Overview
The record describes an Incorrect Authorization flaw (CWE-863) in the reset_user_password and gym_permissions_user_edit views of wger, a free open-source workout and fitness manager. The gym-scope check compares objects with the != operator, which evaluates None != None as False, so the guard is bypassed when both users have no gym assignment.
Impact
- According to the record, a user with the gym.manage_gym permission and no gym assignment can reset the password of another user who also has no gym assignment.
- The new password is returned in plaintext in the HTML response body.
- The victim's original password is invalidated, which the record says locks the victim out.
- The record characterizes the result as full account takeover. The CVSS 3.1 base score of 9.9 (Critical) is provided by the GitHub advisory source.
Affected products and versions
- Product: wger, per the GitHub advisory reference.
- Affected: versions prior to 2.6, as stated in the record description.
- Fixed: version 2.6, as stated in the record description.
- The structured affected and fixes fields in the record are empty, so precise version ranges should be confirmed in the GitHub advisory.
Exploitation status
- The CISA KEV catalog entry in the record is not listed.
- No confirmed exploitation in the wild appears in the sources consulted.
- The EPSS probability in the record is 0.00443 with a percentile of 0.36726.
Remediation and mitigation
- Upgrade wger to version 2.6 or later, which the record states contains the fix.
- Until the upgrade is applied, limit the gym.manage_gym permission to trusted administrators.
- Review which accounts have no gym assignment, since the bypass only applies to that configuration.
- Rotate passwords for accounts that may have been reset through these views, and review administrative activity for unexpected password resets.
Detection guidance
- Review application logs for password reset actions performed by users with the gym.manage_gym permission against accounts without a gym assignment.
- Treat unexpected password resets and subsequent account lockouts as signals worth investigating.
- Confirm the deployed version of wger is 2.6 or later in your inventory.
Limitations of the available information
- The structured affected and fixes data is empty in the record, so the affected range relies on the description text.
- The record does not include the vendor's full technical write-up beyond the description.
- No exploit availability or public proof of concept is stated in the sources consulted.
- SSVC data is not available in the record.
Frequently asked questions
What does this vulnerability allow?
According to the record, a user with gym.manage_gym permission and no gym assignment can reset the password of another user who also has no gym assignment, and the new password is returned in the HTML response.
Which versions are affected?
The record description states that versions prior to 2.6 are affected and that version 2.6 contains the fix. The structured affected fields are empty, so confirm ranges in the GitHub advisory.
Is this vulnerability being exploited in the wild?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
What should administrators do now?
Upgrade wger to version 2.6 or later, restrict the gym.manage_gym permission in the meantime, and review recent password resets for unexpected activity.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.