# wger (PyPI) vulnerabilities 19 known vulnerabilities (1 critical, 7 high, 8 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.1.0 (Oct 11, 2022): affected by 19 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 60 - Dependents: 0 - Releases: 14 since 1.1.0 (Feb 23, 2013) - Registry: https://pypi.org/project/wger/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-46438: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-46437: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-46434: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-45161: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-43976: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-86257: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-86256: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-86255: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-43977: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-43978: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-43948: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-40474: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-40353: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-27839: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-27838: 1.1.0 to 2.1.0 (through the newest release) - CVE-2026-27835: 1.1.0 to 2.1.0 (through the newest release) - CVE-2023-38759: 1.1.0 to 2.1.0 (through the newest release) - CVE-2023-38758: 1.1.0 to 2.1.0 (through the newest release) - CVE-2022-2650: 1.1.0 to 2.1.0 (through the newest release) ## Advisories (19) ### [CVE-2026-46438](https://cve.now/CVE-2026-46438): wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot\_entry - Severity: Medium 6.5 - Published: Oct 7, 2026 - Affected: through 2.1. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2026-46437](https://cve.now/CVE-2026-46437): wger: API credentials remain valid after logout/password change - Severity: Medium 4.8 - Published: Oct 7, 2026 - Affected: through 2.1. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2026-46434](https://cve.now/CVE-2026-46434): wger: Trainer Privilege Escalation - Improper Privilege Management - Severity: High 7.1 - Published: Oct 7, 2026 - Affected: through 2.1. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2026-45161](https://cve.now/CVE-2026-45161): wger: trainer\_login accepts GET - CSRF bypass enables forced session rebinding - Severity: Medium 5.4 - Published: Oct 7, 2026 - Affected: through 2.1. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2026-43976](https://cve.now/CVE-2026-43976): wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views) - Severity: High 7.1 - Published: Oct 7, 2026 - Affected: through 2.1. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2026-86257](https://cve.now/CVE-2026-86257): wger before 2.6 CSV Formula Injection via member export - Severity: Medium 4.8 - Published: Sep 6, 2026 - Affected: fixed in 2.6. - No fix released. The advisory names 2.6 as the fix, which the registry doesn't have yet. The latest release, 2.1.0, is still affected. ### [CVE-2026-86256](https://cve.now/CVE-2026-86256): wger before 2.6 Open Redirect via trainer-login next parameter - Severity: Medium 5.1 - Published: Sep 6, 2026 - Affected: fixed in 2.6. - No fix released. The advisory names 2.6 as the fix, which the registry doesn't have yet. The latest release, 2.1.0, is still affected. ### [CVE-2026-86255](https://cve.now/CVE-2026-86255): wger before 2.5 Uncontrolled Resource Consumption via date\_sequence - Severity: High 7.1 - Published: Sep 6, 2026 - Affected: through 2.5. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2026-43977](https://cve.now/CVE-2026-43977): wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API - Severity: High 7.5 - Published: Jul 16, 2026 - Affected: through 2.5. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2026-43978](https://cve.now/CVE-2026-43978): wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers - Severity: High 8.1 - Published: Jul 16, 2026 - Affected: through 2.5. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2026-43948](https://cve.now/CVE-2026-43948): wger: cross-tenant password reset and plaintext disclosure via gym=None bypass - Severity: Critical 9.9 - Published: May 12, 2026 - Affected: fixed in 2.6. - No fix released. The advisory names 2.6 as the fix, which the registry doesn't have yet. The latest release, 2.1.0, is still affected. ### [CVE-2026-40474](https://cve.now/CVE-2026-40474): wger has Broken Access Control in the Global Gym Configuration Update Endpoint - Severity: High 7.6 - Published: Apr 17, 2026 - Affected: through 2.1. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2026-40353](https://cve.now/CVE-2026-40353): wger: Stored XSS via Unescaped License Attribution Fields - Severity: Medium 5.1 - Published: Apr 17, 2026 - Affected: through 2.4. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2026-27839](https://cve.now/CVE-2026-27839): wger: IDOR in nutritional\_values endpoints exposes private dietary data via direct ORM lookup - Severity: Medium 4.3 - Published: Feb 26, 2026 - Affected: through 2.1. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2026-27838](https://cve.now/CVE-2026-27838): wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data - Severity: Low 3.1 - Published: Feb 26, 2026 - Affected: through 2.1. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2026-27835](https://cve.now/CVE-2026-27835): wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data - Severity: Medium 4.3 - Published: Feb 26, 2026 - Affected: through 2.1. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2023-38759](https://cve.now/CVE-2023-38759): Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges… - Severity: Unrated - Published: Aug 8, 2023 - Affected: through 2.2.0a3; all versions. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2023-38758](https://cve.now/CVE-2023-38758): Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the… - Severity: Unrated - Published: Aug 8, 2023 - Affected: all versions; through 2.2.0a3. - No fix released. The latest release, 2.1.0, is still affected. ### [CVE-2022-2650](https://cve.now/CVE-2022-2650): Improper Restriction of Excessive Authentication Attempts in wger-project/wger - Severity: High 7.8 - Published: Nov 24, 2022 - Affected: fixed in 2.2. - No fix released. The advisory names 2.2 as the fix, which the registry doesn't have yet. The latest release, 2.1.0, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/wger Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.