Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced at runtime. Since GymConfig is an ownerless singleton, any authenticated user can modify the global gym configuration, triggering save() side effects that bulk-update user profile gym assignments — a vertical privilege escalation to installation-wide configuration control. This issue is fixed in version 2.5.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40474 wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' b… https://www.cve.org/CVERecord?id=CVE-2026-40474
Post summary
The CVE points to a missing permissions check in wger’s GymConfigUpdateView for older versions; no PoC or active exploitation is mentioned.
CVE-2026-40474 Privilege Escalation in Wger Fitness Manager Versions 2.5 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40474
Post summary
The post announces a privilege‑escalation vulnerability (CVE‑2026‑40474) affecting Wger Fitness Manager 2.5 and earlier, but provides no PoC, exploit code, active exploitation evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wger | wger | - | - | - |