| शीर्षक | wger-project (https://github.com/wger-project (https://github.co wger Workout Manager 2.6.0-alpha2 (master branch, commit ea78447) ss CWE-352 (Cross-Site Request Forgery — GET-based state change) |
|---|
| विवरण | wger Workout Manager has multiple security vulnerabilities: (1) [HIGH] GET-based CSRF on password reset & account deactivation — reset_user_password() and UserDeactivateView.get_redirect_url() perform state-changing operations (password reset, is_active toggle) on GET requests with no @require_POST or CSRF protection; an attacker can trick an authenticated gym admin into visiting a crafted URL to reset a user's password or deactivate/reactivate an account. (2) [HIGH] IDOR — Missing ownership check on gallery images — ImageUpdateView and ImageDeleteView only require authentication without verifying the image belongs to the current user; any authenticated user can edit or delete any other user's gallery images by supplying a different image PK in the URL. (3) [HIGH] JWT token not revoked on user deactivation — UserDeactivateView sets is_active=False but does not call blacklist_jwt_refresh_tokens(), so deactivated users can still obtain new access tokens via their existing refresh tokens and continue using the API. (4) [HIGH] JWT token not revoked on password reset — reset_user_password() changes the password without calling blacklist_jwt_refresh_tokens(), so an attacker holding a compromised JWT can continue accessing the account even after the password is changed. |
|---|
| स्रोत | ⚠️ https://github.com/wger-project/wger/issues/2380 |
|---|
| उपयोगकर्ता | Galaxyn (UID 98388) |
|---|
| सबमिशन | 15/07/2026 02:19 AM (2 महीनों पहले) |
|---|
| संयम | 29/08/2026 07:50 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397061 [wger-project wger तक 2.6.0-alpha2 Password Reset wger/gym/views/gym.py reset_user_password क्रॉस साइट रिक्वेस्ट फॉर्जरी] |
|---|
| अंक | 20 |
|---|