CVE-2026-40474

CVE-2026-40474 is a privilege escalation vulnerability in wger (a free, open-source fitness management application) versions 2.5 and below. The GymConfigUpdateView fails to enforce required permissions at runtime due to inheriting from WgerFormMixin instead of WgerPermissionMixin, allowing any authenticated user to modify global gym configuration settings. This vulnerability has been patched in version 2.5. The vulnerability carries a HIGH severity rating (CVSS 7.6) with a low attack complexity requiring only network access and valid authentication credentials. Any authenticated user can exploit this to trigger bulk updates affecting user profile assignments across the entire installation, constituting a vertical privilege escalation to installation-wide configuration control. The attack has limited scope to integrity and availability impacts alongside minor confidentiality exposure. There is currently no evidence of active exploitation in the wild, with an extremely low EPSS score of 0.00013, indicating minimal probability of real-world exploitation. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and it remains inactive on vulnerability hot lists. However, organizations running wger versions 2.5 or below should apply the available patch to eliminate this attack vector.