Vulnerabilities

Security incident · CVE-2026-43976

wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

Published Oct 7, 2026 · catalog updated Oct 26, 2026 · wger: cross-tenant admin notes/contracts

Last checked Oct 27, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-43976. EPSS is 0.22%. Act only if a listed version of wger: cross-tenant admin notes/contracts is installed.

Severity

High7.1

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.22%

Remediation

Advisory link

Affected products

PyPI wger

### Summary Five gym management views in wger apply a flawed gym-scope guard ( ) that silently passes when both operands are . A trainer with and permissions and no gym assignment ( ) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied with no secondary gym-scoped validation, so all records are disclosed. ### Details **Files**: , , , , The same flawed comparison pattern appears across at least five views: When both and are , Python evaluates as , and is never reached. The subsequent queryset applies only the attacker-supplied (user ID) as a filter — there is no secondary check tying the queryset to the requesting trainer's gym. All private admin notes, documents, and contracts for the target user are returned in the response body. **Affected endpoints**: - -> admin notes list view - -> documents list view - -> contracts list view - -> user config view - -> permission edit view **Suggested patch**: Extract a shared helper and call it consistently from all five affected views to eliminate future drift. ### PoC Tested on Docker image. Test users: ( + permissions, ) and (regular user, , has a private admin note pre-seeded). **Step 1** - Authenticate as trainer with required perms and gym=None: **Step 2** - Read victim's private admin notes: **Step 3** - Read victim's documents and contracts (same pattern): **Step 4** (optional) - Mass enumeration across all gym=None users: **RBAC Disproof Protocol**: - Scenario A (admin, gym=1 -> member gym=1) -> HTTP 200 (expected - same-gym read is a documented feature) - Scenario B (trainer1, gym=None -> alice gym=None) -> **HTTP 200 with PII in body** (expected HTTP 403) - Scenario C (admin, gym=1 -> alice gym=None) -> HTTP 403 (expected - guard works when gyms differ; confirms bypass is -specific) Reproducibility: 2/2 runs after clean-baseline database reset. ##