GYM One: Stored cross-site scripting in admin user list
Summary
GYM One, an open-source gym management application, does not HTML-encode the stored firstname, lastname and email profile fields when they are shown in the administrator user list (admin/users/index.php). An attacker who can store values in these fields can run script in the browser of an administrator who opens /admin/users/. The persistent script can access administrator session data or perform actions with administrator privileges until the stored record is removed. Exploitation requires that the attacker can write profile data and that an administrator views the list.
Affected
- GYM-One versions before 1.4.1 (CVE record). The GHSA advisory names v1.1.0 as vulnerable; treat all versions below 1.4.1 as affected.
Fixed in
- Version 1.4.1 (release V1.4.1, published 15 June 2026).
Workaround
Unknown. The CVE record and vendor sources document no workaround.
Exploitation
- CISA SSVC: exploitation "poc", automatable "no", technical impact "total".
- Not listed in CISA KEV; EPSS below 1% (per OpenCVE).
- No public exploit repository found in the research; not reproduced.
Our recommendation
- Check the GYM One version now. If it is below 1.4.1, upgrade to 1.4.1 or later; 1.4.1 also fixes CVE-2026-55871 (SQL injection in the same file).
- Until patched, restrict /admin/ to management networks or VPN.
- Review existing firstname, lastname and email records for script or HTML content.
- Restrict who can create or edit member profiles.
- Ask administrators to avoid the user list until the update is applied.
- Monitor for unexpected administrator actions and session activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub commit d3a0cf1 (GYM-One) github.com
- GYM-One Release V1.4.1 github.com
- GitHub Security Advisory GHSA-75g9-vp9w-5388 github.com
- OpenCVE: CVE-2026-55872 app.opencve.io
- SentinelOne: CVE-2026-55872 www.sentinelone.com
- Mend/Vulners: CVE-2026-55872 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:26.
Original description (NVD)
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with the administrator's privileges until the stored record is removed. This issue is fixed in version 1.4.1.
NVD references (4)
- https://github.com/mayerbalintdev/GYM-One/commit/d3a0cf134f0ab3ac12aee7dca283b93c4290dcc4
- https://github.com/mayerbalintdev/GYM-One/releases/tag/V1.4.1
- https://github.com/mayerbalintdev/GYM-One/security/advisories/GHSA-75g9-vp9w-5388
- https://github.com/mayerbalintdev/GYM-One/security/advisories/GHSA-75g9-vp9w-5388
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.