Vulnerability DatabaseCVE-2026-82544
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-82544
Published:August 30, 2026
Updated:September 24, 2026
A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This patch is called 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314. It is advisable to implement a patch to correct this issue.
Related Resources (10)
https://github.com/wger-project/wger/issues/2380
https://vuldb.com/vuln/397061
https://vuldb.com/submit/891417
https://github.com/wger-project/wger/commit/3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314
https://github.com/wger-project/wger/pull/2415
https://vuldb.com/vuln/397061/cti
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82544.json
https://github.com/wger-project/wger/
https://nvd.nist.gov/vuln/detail/CVE-2026-82544
https://vuldb.com/cve/CVE-2026-82544
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
Exploit Maturity
NOT DEFINED
CVSS v3
Base Score:
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Exploit Maturity
NOT DEFINED
Weakness Type (CWE)
Missing Authorization
CWE-862
Cross-Site Request Forgery (CSRF)
CWE-352
EPSS
Base Score:
0.17