CVE-2026-82544: Cross-Site Request Forgery in wger-project wger

CVE-2026-82544 describes a CSRF vulnerability in the wger-project wger software affecting the reset_user_password function in the file wger/gym/views/gym.py. The vulnerability allows remote attackers to perform unauthorized password reset actions by exploiting insufficient request validation. The affected version is 2.6.0-alpha2. A patch commit (3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314) has been identified to fix this issue, though no official vendor advisory or remediation level is provided.

Successful exploitation could allow an attacker to trick a logged-in user into unknowingly resetting their password, potentially leading to account access disruption or unauthorized access if combined with other weaknesses. The vulnerability requires user interaction and does not require privileges, but it has limited impact due to the need for user involvement.

A patch commit is available to fix this vulnerability. It is advisable to apply the patch identified by commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 to remediate the issue. Since no official vendor advisory or remediation level is provided, users should monitor the vendor's repository or official channels for an official fix release. Until patched, implementing CSRF protections such as anti-CSRF tokens on the affected endpoint may mitigate the risk.