wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error. Because `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with no user filter, the attacker's injected data is silently folded into the victim's progressive-overload calculations, corrupting their auto-generated weight and repetition targets. Version 2.6 contains a patch.
wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding any one of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.
wger contains an access control vulnerability affecting five gym management views where a gym-scope guard fails when both the requesting trainer and target user have no gym assigned (gym=None). This flaw allows an authenticated trainer with specific permissions and no gym assignment to access private admin notes, documents, contracts, user configurations, and permissions of any other unaffiliated user with gym=None. The root cause is a comparison that incorrectly allows access when both gym values are None, combined with querysets that lack secondary gym-scoped filtering.
wger is a free, open-source workout and fitness manager. Prior to 2.6, the reset_user_password and gym_permissions_user_edit views in wger perform a gym-scope authorization check using Python object comparison (!=) that evaluates None != None as False, silently bypassing the guard when both the attacker and victim have no gym assignment (gym=None). A user with gym.manage_gym permission and gym=None can reset the password of any other gym=None user; the new plaintext password is returned verbatim in the HTML response body, enabling one-shot full account takeover. The victim's original password is invalidated, locking them out permanently. This vulnerability is fixed in 2.6.
The wger application has an open redirect vulnerability in the trainer_login view where the ?next= parameter is not validated against allowed hosts before redirecting. This allows an attacker to craft a URL that redirects a trainer user to an arbitrary external site after impersonation mode is activated. The redirect leaks the original wger URL via the Referer header and can facilitate phishing or credential harvesting. The issue affects wger versions prior to 2.6 and has a medium severity CVSS score of 5.4.
The wger gym member TSV export endpoint writes user profile fields first_name and last_name directly into TSV cells without sanitizing formula prefixes. This allows any gym member to inject spreadsheet formulas into their profile fields, which execute when a gym admin exports and opens the member list in Excel, LibreOffice Calc, or Google Sheets. The executed formulas can exfiltrate data or, on legacy Excel with DDE enabled, execute arbitrary code locally. This vulnerability affects wger versions prior to 2.6 and has a high severity rating (CVSS 7.4).
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` return all users' repetition config data because their `get_queryset()` calls `.all()` instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure. Commit 1fda5690b35706bb137850c8a084ec6a13317b64 contains a fix for the issue.