Vulnerability · Published Oct 15, 2026 · Assigned by GitHub_M
CVE-2026-55872GYM One admin user list is vulnerable to stored cross-site scripting
High 8.7
In plain English
A high-severity cross-site scripting in GYM-One from mayerbalintdev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with the administrator's privileges until the stored record is removed. This issue is fixed in version 1.4.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mayerbalintdev | GYM-One | < 1.4.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N