CVE-2026-55872: GYM One Stored XSS Vulnerability

CVE-2026-55872 Overview

CVE-2026-55872 is a stored Cross-Site Scripting (XSS) vulnerability in GYM One, an open-source gym management application used by fitness centers, personal trainers, and sports clubs. Versions prior to 1.4.1 fail to HTML-encode the firstname, lastname, and email profile fields when rendering them in admin/users/index.php. Any user who can populate these fields can inject script content that executes in an administrator's browser when the admin opens /admin/users/. The vulnerability is tracked under [CWE-79] and resolved in version 1.4.1.

Critical Impact

Attackers with low-privilege accounts can hijack administrator sessions or perform privileged actions by injecting persistent JavaScript into profile fields that are rendered in the admin user list.

Affected Products

• GYM One versions prior to 1.4.1
• Component: admin/users/index.php
• Fixed in: GYM One 1.4.1

Discovery Timeline

• 2026-10-15 - CVE-2026-55872 published to NVD
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-55872

Vulnerability Analysis

The vulnerability resides in the administrator user listing page at admin/users/index.php. The page reads stored user profile values (firstname, lastname, email) directly from the database and emits them into the rendered HTML without applying output encoding. Because the attacker-supplied content lands inside an HTML context, injected <script> tags or event-handler payloads execute inside the administrator's authenticated browser session.

Exploitation requires only the ability to store values in profile fields, so any authenticated low-privilege user — or in some deployments, a self-registered user — can plant a payload. When the administrator visits the user list, the injected script runs under the admin origin and can read session data, invoke privileged endpoints, or create new administrator accounts.

Root Cause

The root cause is missing output encoding. GYM One stores raw user input in the database and renders it inside HTML markup without passing the values through htmlspecialchars() or an equivalent encoder. There is no Content Security Policy (CSP) in place to constrain inline script execution, so a single unescaped field is sufficient for full script execution.

Attack Vector

The attack is network-reachable and requires low privileges plus one user interaction (an administrator viewing the user list). An attacker updates their own profile — or registers a new user — with a payload such as <img src=x onerror=...> placed in firstname, lastname, or email. The next administrator who loads /admin/users/ triggers the payload. The scope is changed because the script executes in the administrator's security context, not the attacker's.

# Patch excerpt from GYM One V1.4.1
# Related hardening in the same release switches raw SQL concatenation
# to prepared statements in admin/boss/chroom/index.php:

-    $sql = "INSERT INTO lockers (lockernum, gender) VALUES ('$szekreny_szam', '$oltozo')";
-    if ($conn->query($sql) === TRUE) {
+    $sql = "INSERT INTO lockers (lockernum, gender) VALUES (?, ?)";
+    $stmt = $conn->prepare($sql);
+    $stmt->bind_param("ss", $szekreny_szam, $oltozo);
+    if ($stmt->execute() === TRUE) {

# Source: https://github.com/mayerbalintdev/GYM-One/commit/d3a0cf134f0ab3ac12aee7dca283b93c4290dcc4

Detection Methods for CVE-2026-55872

Indicators of Compromise

• Profile records in the users table where firstname, lastname, or email contain HTML tags, <script>, javascript:, on<event>= handlers, or encoded equivalents.
• Unexpected administrator-initiated actions (new admin accounts, permission changes) correlated with recent visits to /admin/users/.
• Outbound requests from administrator browsers to attacker-controlled domains shortly after loading the admin user list.

Detection Strategies

• Review web server access logs for requests to /admin/users/ immediately followed by anomalous privileged API calls from the same session.
• Run database queries that flag profile fields containing angle brackets, script, onerror, onload, or URL-encoded variants of these tokens.
• Enable browser-side CSP reporting on the admin console to surface inline script execution attempts.

Monitoring Recommendations

• Alert on creation or modification of administrator accounts outside of change-management windows.
• Monitor for unusual DOM-sourced network beacons originating from administrator browser sessions.
• Track updates to user profile fields that occur immediately before an administrator login event.

How to Mitigate CVE-2026-55872

Immediate Actions Required

• Upgrade GYM One to version 1.4.1 or later as published in the GYM One V1.4.1 release.
• Audit the users table for stored HTML or script payloads in firstname, lastname, and email and sanitize or remove offending records.
• Rotate administrator session cookies and reset credentials for any account that viewed /admin/users/ while a payload may have been present.

Patch Information

The fix is delivered in GYM One 1.4.1 and documented in GitHub Security Advisory GHSA-75g9-vp9w-5388. The remediation commit is available at the GYM One patch commit d3a0cf1, which introduces HTML output encoding for the affected profile fields.

Workarounds

• Restrict access to /admin/users/ to trusted network ranges via a reverse proxy or web application firewall until the patch is applied.
• Deploy a WAF rule that blocks HTML metacharacters in profile update requests to firstname, lastname, and email.
• Apply a strict Content Security Policy that disallows inline scripts (script-src 'self') on the admin interface to limit payload execution.

# Example nginx hardening for the admin interface
location /admin/users/ {
    allow 10.0.0.0/8;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer" always;
}