Executive brief
Wger is a self-hosted fitness and workout tracker application. A cross-site request forgery (CSRF) vulnerability in the password reset function allows attackers to craft malicious requests that force users to change passwords without their knowledge or consent. An attacker could leverage this to lock users out of their accounts or reset passwords to gain unauthorized access.
Technical details
The vulnerability exists in the reset_user_password function within wger/gym/views/gym.py, where password reset operations accept HTTP GET requests that should require POST. CSRF tokens were not properly validated or enforced for state-modifying operations. An attacker can craft a malicious link or embed it in a web page, and when a logged-in user visits it, their browser automatically sends the request with valid session credentials. The attack is remotely exploitable and does not require authentication beyond the user visiting the malicious content. The fix requires enforcing POST-only methods and implementing proper CSRF protection for password reset and user (de)activation endpoints, as addressed in commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314.
Affected products
- wger-project wger up to 2.6.0-alpha2
Timeline
- 2026-08-30: disclosed
- 2026-07-09: patched: Patch commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314