CVE-2026-55871

CVSS 6.5 (medium) · published 2026-10-15

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without prepared statements. An authenticated administrator can inject SQL through either search field to read data from arbitrary tables, including user information and password hashes. Depending on database permissions, the same injection may also permit filesystem writes. This issue is fixed in version 1.4.1.

Weakness: CWE-89

Source: NVD CVE-2026-55871

References

• https://github.com/mayerbalintdev/GYM-One/commit/d3a0cf134f0ab3ac12aee7dca283b93c4290dcc4
• https://github.com/mayerbalintdev/GYM-One/releases/tag/V1.4.1
• https://github.com/mayerbalintdev/GYM-One/security/advisories/GHSA-9j4g-cq35-8997
• https://github.com/mayerbalintdev/GYM-One/security/advisories/GHSA-9j4g-cq35-8997

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.