wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.
Summary
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information. This issue has been fixed in version 2.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wger-project | wger | before 2.6 | 2.6 | Patch available | CNA |
| — | wger (PyPI) | up to 2.5 | — | No fix listed | GHSA-9qpr-vc49-hqg2 |
- wger Vendorwger-project Affected before 2.6 Fixed in 2.6 Patch available CNA
- wger (PyPI) Vendor— Affected up to 2.5 Fixed in — No fix listed GHSA-9qpr-vc49-hqg2
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* | — | — | wger-project |
- cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* Versions — — ·wger-project
Remediation
- Fix · CNA wger (wger-project) Fixed in 2.6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-43978
- 2026-10-03 Alias added: GHSA-9qpr-vc49-hqg2
- 2026-11-06 5 new references · GHSA-9qpr-vc49-hqg2
References
Advisory 2
Other 5
- https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2
- https://github.com/wger-project/wger/commit/19c97822492f9914ccfcebeeda319be4e7562790
- https://github.com/pypa/advisory-database/tree/main/vulns/wger/PYSEC-2026-3420.yaml
- https://github.com/wger-project/wger
- https://pypi.org/project/wger
More wger-project vulnerabilities
- TI-2026-32005 wger: cross-tenant password reset and plaintext disclosure via gym=None bypass CVSS 3.1CRITICAL 9.9
- TI-2022-02450 Improper Restriction of Excessive Authentication Attempts in wger-project/wger CVSS 3.1CRITICAL 9.8
- TI-2023-20093 Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager… CVSS 3.1HIGH 8.8
- TI-2026-32021 wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API CVSS 3.1HIGH 7.5
- TI-2026-29226 wger has Broken Access Control in the Global Gym Configuration Update Endpoint CVSS 3.1HIGH 7.6
- TI-2026-69145 wger: Trainer Privilege Escalation through Improper Privilege Management CVSS 3.1HIGH 7.1
Sources
- CVE-2026-43978 · CVE Program
- CVE-2026-43978 · NVD
- FIRST EPSS
- GHSA-9qpr-vc49-hqg2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences