CVE-2026-40474

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced at runtime. Since GymConfig is an ownerless singleton, any authenticated user can modify the global gym configuration, triggering save() side effects that bulk-update user profile gym assignments — a vertical privilege escalation to installation-wide configuration control. This issue is fixed in version 2.5.

• CWE-284
• CWE-862

• https://github.com/wger-project/wger/commit/47ee5af93b3ced24b9f94b0a8b9296b50bc9523fPatch
• https://github.com/wger-project/wger/releases/tag/2.5Release Notes
• https://github.com/wger-project/wger/security/advisories/GHSA-xppv-4jrx-qf8mExploit, Vendor Advisory

Published

Apr 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40468Integer overflow vulnerability has been found in "builtin.c"…9.1
• CVE-2026-40469Integer overflow vulnerability has been found in "builtin.c"…9.1
• CVE-2026-40470A critical XSS vulnerability affected hackage-server and hac…9.9
• CVE-2026-40471hackage-server lacked Cross-Site Request Forgery (CSRF) prot…9.6
• CVE-2026-40472In hackage-server, user-controlled metadata from .cabal file…9.9
• CVE-2026-40473The camel-mina component's MinaConverter.toObjectInput(IoBuf…8.8
• CVE-2026-40476graphql-go is a Go implementation of GraphQL. In versions 15…7.5
• CVE-2026-40477Thymeleaf is a server-side Java template engine for web and …9
• CVE-2026-40478Thymeleaf is a server-side Java template engine for web and …9
• CVE-2026-40479Kimai is an open-source time tracking application. In versio…5.4
• CVE-2026-4048OS Command Injection Remote Code Execution Vulnerability in …7.2
• CVE-2026-40480ChurchCRM is an open-source church management system. In ver…7.1