# CVE-2026-82544: Wger password reset cross-site request forgery

Source: https://junglewise.ai/threats/cve-2026-82544-wger-password-reset-cross-site-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82544 · Severity: medium · CVSS 4.3 · Published 2026-08-30

Wger is a self-hosted fitness and workout tracker application. A cross-site request forgery (CSRF) vulnerability in the password reset function allows attackers to craft malicious requests that force users to change passwords without their knowledge or consent. An attacker could leverage this to lock users out of their accounts or reset passwords to gain unauthorized access.

## Quick answers

**Is CVE-2026-82544 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82544 being exploited in the wild.

**How severe is CVE-2026-82544?** Medium severity, with a CVSS score of 4.3, published 30 August 2026.

**Which products and versions are affected?** wger-project wger up to 2.6.0-alpha2.

**Is there a fix for CVE-2026-82544?** A patch was published on 2026-07-09: Patch commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82544 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82544?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the reset_user_password function within wger/gym/views/gym.py, where password reset operations accept HTTP GET requests that should require POST. CSRF tokens were not properly validated or enforced for state-modifying operations. An attacker can craft a malicious link or embed it in a web page, and when a logged-in user visits it, their browser automatically sends the request with valid session credentials. The attack is remotely exploitable and does not require authentication beyond the user visiting the malicious content. The fix requires enforcing POST-only methods and implementing proper CSRF protection for password reset and user (de)activation endpoints, as addressed in commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314.

## Affected products

- wger-project wger up to 2.6.0-alpha2

## Timeline

- 2026-08-30: disclosed
- 2026-07-09: patched: Patch commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314

## References

- [https://github.com/wger-project/wger/](https://github.com/wger-project/wger/)
- [https://github.com/wger-project/wger/commit/3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314](https://github.com/wger-project/wger/commit/3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314)