wger gym views leak other users' admin notes and contracts
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
wger before 2.6 and the wger PyPI package through 2.1 are affected. Five gym management views use a flawed gym-scope check (CWE-863) that passes when both compared values are None. A remote attacker with low privileges, trainer permissions and no gym assignment can read private admin notes, uploaded documents, gym contracts and permission data of unaffiliated users on the instance.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed. Version 2.6 fixes the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wger-project | wger | before 2.6 | 2.6 | Patch available | CNA |
| — | wger (PyPI) | up to 2.1 | — | No fix listed | GHSA-c72h-82w6-rqfp |
- wger Vendorwger-project Affected before 2.6 Fixed in 2.6 Patch available CNA
- wger (PyPI) Vendor— Affected up to 2.1 Fixed in — No fix listed GHSA-c72h-82w6-rqfp
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* | — | — | wger-project |
- cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* Versions — — ·wger-project
Remediation
Upgrade wger to version 2.6, which fixes the issue. The sources list no fixed version for wger.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA wger (wger-project) Fixed in 2.6
Timeline
- 2026-10-07 Threatist record created from CVE-2026-43976
- 2026-10-07 Alias added: GHSA-c72h-82w6-rqfp
- 2026-10-07 Affected versions changed · GHSA-c72h-82w6-rqfp
- 2026-10-07 CVSS score added · GHSA-c72h-82w6-rqfp
- 2026-10-07 Weakness changed · GHSA-c72h-82w6-rqfp
- 2026-10-07 3 new references · GHSA-c72h-82w6-rqfp
- 2026-10-07 CISA SSVC decision points changed
References
Other 7
- https://github.com/wger-project/wger/security/advisories/GHSA-c72h-82w6-rqfp
- https://github.com/wger-project/wger/releases/tag/2.6
- https://github.com/wger-project/wger/commit/b51f472ab2f790d8b4e67b4371bd6d1915af2930
- https://github.com/wger-project/wger/commit/e1d329ff4ef6213b0a1adc5daf115e6d8981190c
- https://github.com/pypa/advisory-database/tree/main/vulns/wger/PYSEC-2026-4313.yaml
- https://github.com/wger-project/wger
- https://pypi.org/project/wger
More wger-project vulnerabilities
- TI-2026-32005 wger: cross-tenant password reset and plaintext disclosure via gym=None bypass CVSS 3.1CRITICAL 9.9
- TI-2022-02450 Improper Restriction of Excessive Authentication Attempts in wger-project/wger CVSS 3.1CRITICAL 9.8
- TI-2023-20093 Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager… CVSS 3.1HIGH 8.8
- TI-2026-32021 wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API CVSS 3.1HIGH 7.5
- TI-2026-32022 wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers CVSS 3.1HIGH 8.1
- TI-2026-29226 wger has Broken Access Control in the Global Gym Configuration Update Endpoint CVSS 3.1HIGH 7.6
Sources
- CVE-2026-43976 · CVE Program
- CVE-2026-43976 · NVD
- FIRST EPSS
- GHSA-c72h-82w6-rqfp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences