CVE-2026-82544 wger-project wger Password Reset gym.py reset_user_password cross-site request forgery
Attackers can perform cross-site request forgery on the password reset function, potentially taking over user accounts in the wger fitness application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-82544?
CVE-2026-82544 is a medium-severity vulnerability in wger-project wger, published on 30 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This patch is called 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314. It is advisable to implement a patch to correct this issue.
Which versions are affected by CVE-2026-82544?
How do I fix CVE-2026-82544?
No fix has been published for CVE-2026-82544 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82544 being exploited?
There is no known exploitation of CVE-2026-82544 in the wild and no public exploit code.
Sources
Also known as GHSA-frcw-fw5q-gh4g.