CVE-2026-45161Medium· 5.4▾ Sunlitwger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login()` without any CSRF protection, because Django's `CsrfViewMiddleware` only en…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
wger is a free, open-source workout and fitness manager. Prior to version 2.6, the trainer_login view in wger accepts GET requests and executes django_login() without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods (POST/PUT/PATCH/DELETE). An attacker can embed a single <img> tag on a malicious page; when an authenticated trainer loads that page, their browser auto-issues the GET with the session cookie, forcibly rebinding the trainer's session to an arbitrary user account. Version 2.6 fixes the issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
wger <= 2.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-46437Medium· 4.8wger is a free, open-source workout and fitness manager
CVE-2026-46438Medium· 6.5wger is a free, open-source workout and fitness manager
CVE-2026-46434High· 7.1wger is a free, open-source workout and fitness manager
CVE-2026-43976High· 7.1wger is a free, open-source workout and fitness manager
CVE-2026-86257Medium· 5.4wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas
CVE-2026-86256Medium· 5.4wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py)