CVE-2026-40474: 
Python vulnerability analysis and mitigation

CVE-2026-40474 is a broken access control vulnerability in the wger workout manager application affecting the global gym configuration update endpoint (/config/gym-config/edit). Any authenticated low-privileged user can modify installation-wide configuration settings due to a missing authorization check, constituting a vertical privilege escalation. All versions prior to 2.5 are affected (tested on wger 2.5.0a1 pre-release and commit bf7ed9f57). It carries a CVSS v3.1 base score of 7.6 (High) (GitHub Advisory, wger Security Advisory). The vulnerability was published on April 15, 2026, and reported by researcher VashuVats.

The root cause is classified as CWE-284 (Improper Access Control) and CWE-862 (Missing Authorization). The GymConfigUpdateView class in wger/config/views/gym_config.py declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of the project's WgerPermissionMixin, which is the only mixin that actually enforces permission checks at runtime. WgerFormMixin only performs object ownership checks; since GymConfig is a singleton (pk=1) and does not implement get_owner_object(), the mixin catches an AttributeError and sets owner_object = False, bypassing all access restrictions entirely. The fix requires adding WgerPermissionMixin before WgerFormMixin in the class inheritance chain and setting login_required = True (wger Security Advisory, Patch Commit).

A successful exploit allows any authenticated user to modify the installation-wide GymConfig singleton, triggering significant server-side side effects in GymConfig.save(): all UserProfile records with no gym assignment are bulk-updated to the attacker-specified default gym, and GymUserConfig records are created for affected users. On multi-tenant deployments, this enables unauthorized manipulation of tenant assignment defaults, affecting both existing users and new registrations, violating the administrative trust boundary. The primary impact is high integrity loss (bulk modification of other users' records), with low confidentiality and availability impact (wger Security Advisory).

A proof-of-concept with concrete reproduction steps is publicly available in the GitHub security advisory, demonstrating exploitation via a simple authenticated HTTP POST request with no special tooling required (wger Security Advisory). The EPSS score is approximately 0.034% (3rd percentile), indicating low current probability of automated exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a valid low-privileged account on the target wger instance (Feedly).

1. Reconnaissance: Identify a wger instance running a version prior to 2.5. The endpoint /config/gym-config/edit is accessible via HTTP GET even to unauthenticated users, confirming the target is vulnerable.
2. Obtain a low-privileged account: Register or use any existing authenticated user account on the target wger instance — no special permissions are required.
3. Identify available gym IDs: Browse the application or use the wger REST API (e.g., /api/v2/gym/gym/) to enumerate valid gym IDs that can be set as the default.
4. Submit the malicious POST request: Send an authenticated HTTP POST to /config/gym-config/edit with the form field default_gym set to the desired gym ID (e.g., default_gym=1). Standard browser form submission or a tool like curl with a valid session cookie is sufficient.
5. Verify exploitation: The application redirects to /en/gym/list (which may show a 'Forbidden' page for low-privileged users), but the GymConfig singleton has already been updated. Confirm by querying the database or observing that users previously lacking a gym assignment have been bulk-updated to the specified gym (wger Security Advisory).

• Network: Authenticated HTTP POST requests to /config/gym-config/edit originating from non-administrative user accounts; unexpected access to this endpoint from regular user sessions.
• Logs: Application access logs showing POST requests to /config/gym-config/edit from accounts without the config.change_gymconfig permission; HTTP 302 redirects to /en/gym/list followed by a 403 response for the same session (indicating the form was submitted successfully but the redirect target is permission-protected).
• Database: Unexpected changes to the GymConfig table's default_gym_id field; bulk updates to UserProfile records setting previously null gym fields to a new value; unexpected creation of GymUserConfig records for multiple users in a short time window (wger Security Advisory).

Upgrade wger to version 2.5 or later, which includes the fix in commit 47ee5af that adds WgerPermissionMixin to the GymConfigUpdateView inheritance chain and sets login_required = True (wger Release 2.5, Patch Commit). If immediate upgrade is not possible, restrict network access to the /config/gym-config/edit endpoint at the web server or reverse proxy level to administrative IP ranges only. Administrators should audit the GymConfig table and UserProfile gym assignments for unexpected changes as part of incident response.

The vulnerability was reported by researcher VashuVats and published by project maintainer rolandgeider on April 15, 2026, with a patch released the same day in wger 2.5 (GitHub Advisory). A brief mention appeared on Mastodon via @thehackerwire shortly after disclosure. No significant broader media coverage or notable security community commentary beyond the advisory itself has been identified.