ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-43978

wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager

Published May 14, 2026 · catalog updated Nov 6, 2026 · wger: Privilege escalation via

Last checked Nov 11, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-43978. EPSS is 0.27%. Act only if a listed version of wger: Privilege escalation via is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (wger: Privilege escalation via).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High8.1
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.27%
Remediation
Advisory link
Affected products
PyPI wger

### Summary A gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag is set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers. ### Details In lines 169–178, the permission check uses an AND condition: After hop 1 (trainer → regular user), is the regular user who has no permission, but is set. Line 169 evaluates: → the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds. ### PoC Requirements: A running wger instance with at least one gym trainer account and one gym manager account in the same gym. Output on wger 2.5.0a2: ### Impact Any authenticated gym trainer can take over a gym manager or general gym manager account within the same gym. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information. ### How to fix The root cause is a logical error in wger/core/views/user.py at line 169. The AND operator means that if session['trainer.identity'] is set, the entire permission check is skipped — allowing any user who has previously been switched into to perform further trainer-login hops without holding the gym.gym_trainer permission themselves. Additionally, the target-user protection block at line 173 only executes when request.user is a trainer, so it never fires during a chained hop. Vulnerable code (user.py:169–178): Suggested fix:

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI wger0 → 2.5

How to fix CVE-2026-43978

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-43978. EPSS is 0.27%. Act only if a listed version of wger: Privilege escalation via is installed.

Which versions are affected?

Compare what you have installed with 0 → 2.5. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-269: Improper Privilege Management. EPSS 0.27%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 22, 2026 · urlscan.io

    Detected

    CVE Record: CVE-2026-43978

  2. Nov 6, 2026 · GitHub Advisory Database

    Fix available

    wger fixed in 2.5

  3. Nov 6, 2026 · GitHub Advisory Database

    Updated

    ### Summary A gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag is set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account

Sources

  • CVE.orgVulnerability recordCVE-2026-43978

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-9qpr-vc49-hqg2

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisorypypi/wger/CVE-2026-43978.yml

    A gym trainer can escalate their session to any higher-privileged flag \nis set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers." -date: "2026-05-14" +date: "2026-11-06" pubdate: "2026-05-14" affected_range: "<=2.5.0" fixed_versions: [] @@ -23,6 +23,10 @@ urls: - "https://nvd.nist.gov/vuln/

    gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-9qpr-vc49-hqg2

    wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager

    osv.dev
  • PyPA Advisory DatabasePackage advisoryGHSA-9qpr-vc49-hqg2

    wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager

    osv.dev
  • urlscan.ioThreat intelligenceCVE-2026-43978
    urlscan.io

References

Freshness

Last verified in this catalog Nov 11, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • PyPA Advisory DatabaseNov 7, 2026
  • GitLab Advisory DatabaseNov 6, 2026
  • GitHub Advisory DatabaseNov 6, 2026
  • OpenSSF OSV / OSV ScannerNov 6, 2026
  • CVE.orgNov 4, 2026
  • urlscan.ioNov 2, 2026