Does GYM One <1.4.1 Risk Admin Privilege Escalation via Stored XSS?

The short version

• GYM One software before version 1.4.1 contains a stored XSS vulnerability.
• Attackers can inject malicious scripts via user profile fields.
• These scripts execute when administrators view the user list page.

The details

GYM One is open-source management software used by fitness centres, personal trainers and sports clubs. According to the National Vulnerability Database record for CVE-2026-55872, the application fails to encode HTML output for specific user profile fields. The affected fields include the first name, last name and email address stored in the system.

The flaw exists within the admin/users/index.php file. This component renders the stored profile data directly into the administrator user list interface. Because the output is not encoded, any malicious script stored in those fields will execute in the browser of any administrator who visits the page. The National Vulnerability Database assigns a CVSS score of 8.7, classifying the severity as high.

The context

An attacker who can store values in the affected profile fields can trigger this execution. When an administrator views the user list at the /admin/users/ endpoint, the persistent script runs in their browser session. This allows the script to access administrator session data or perform actions with the administrator's privileges. The threat persists until the stored record containing the malicious payload is removed from the system.

Next steps

The vendor has released version 1.4.1 to address this issue. This update fixes the improper output encoding in the admin user list interface. Administrators running versions prior to 1.4.1 should upgrade immediately to mitigate the risk. Until the update is applied, the stored scripts remain active and capable of executing against any privileged user accessing the interface.

What defenders should look for

Teams usually monitor for unusual script tags or event handlers appearing in user profile fields within application logs. Check whether any user records contain unexpected HTML or JavaScript code in name or email columns. Look for alerts indicating that an administrator session accessed the user management page shortly after a new user was created or edited. If suspicious content is found, isolate the affected database records and review administrator session tokens for signs of compromise.

What to do and how to stay safe: GYM One

• Audit all user profile fields in your database for unexpected HTML or script tags.
• Restrict access to the admin user list page to trusted networks where possible.
• Monitor administrator session activity for actions that do not match typical user behaviour.
• Plan to upgrade to version 1.4.1 or later once the vendor provides the update.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of GYM One are affected by CVE-2026-55872?

All versions of GYM One prior to 1.4.1 are affected by this vulnerability.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates the CVSS score as 8.7.

Is there a fix available for this stored XSS issue?

Yes, the issue is fixed in version 1.4.1 of the software.