CVE-2026-55872

Name of the Vulnerable Software and Affected Versions GYM One versions prior to 1.4.1

Description The software fails to apply HTML output encoding when rendering profile fields in the administrator user list. An attacker can store malicious scripts in the firstname, lastname, and email fields, which then execute in the browser of an administrator visiting the '/admin/users/index.php' endpoint. This persistent script allows the attacker to access administrator session data or perform actions using administrator privileges.

Recommendations Update to version 1.4.1.