CVE-2026-82544CWE-352CWE-862broken-access-controlcsrf

CVE-2026-82544

Medium · published August 30, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This patch is called 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314. It is advisable to implement a patch to correct this issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00241 · 14.3th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2026-08-30T18:17Z
References (8)
https://github.com/wger-project/wger/ · [email protected]https://github.com/wger-project/wger/commit/3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 · [email protected]https://github.com/wger-project/wger/issues/2380 · [email protected]https://github.com/wger-project/wger/pull/2415 · [email protected]https://vuldb.com/cve/CVE-2026-82544 · [email protected]https://vuldb.com/submit/891417 · [email protected]https://vuldb.com/vuln/397061 · [email protected]https://vuldb.com/vuln/397061/cti · [email protected]
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 30 AUG 13:45Z
    wger-project wger Password Reset gym.py reset_user_password cross-site request forgery
    cvelistv5