CVE-2026-43976 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...

CVE-2026-43976 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...

CVE-2026-43976 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...

EUVD-2026-94328

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...

CVE-2026-43976

The wger fitness manager is vulnerable to a cross-tenant data leak in versions prior to 2.6 . A flaw in the gym-scope guard (gym_a != gym_b) allows it to silently pass when both operands are None. Consequently, a trainer with gym.gym_trainer and gym.add_adminusernote permissions but no gym assign...

CVE-2026-46437: Improper Authentication

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

CVE-2026-43976: Incorrect Authorization

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...

CVE-2026-45161: Cross-Site Request Forgery (CSRF)

wger is a free, open-source workout and fitness manager. Prior to version 2.6, the trainerlogin view in wger accepts GET requests and executes djangologin without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attacker can...

CVE-2026-46434: Improper Privilege Management

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gymtrainer permission can deactivate any account in the same gym, including gymmanager and generalgymmanager accounts. The UserDeactivateView grants access to anyone holding any one of gym.managegy...

CVE-2026-46438: Authorization Bypass Through User-Controlled Key

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

PT-2026-107508

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6 Description Five gym management views contain a flawed gym-scope guard that fails when both compared operands are None. An authenticated trainer possessing gym.gym trainer and gym.add adminusernote permissions who is...

PT-2026-107509

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6 Description The trainer login view in wger is susceptible to Cross-Site Request Forgery CSRF, a condition where a malicious site tricks a user's browser into performing an unwanted action on a different website. This...

PT-2026-107514

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6 Description A privilege management issue exists where a user with the gym trainer permission can deactivate any account within the same gym, including those with higher privileges such as gym manager and general gym...

PT-2026-107515

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6 Description A flaw in the authentication and session lifecycle allows bearer-style API credentials to remain valid after a user logs out or changes their password. An attacker who obtains a victim's DRF authtoken or...

PT-2026-107516

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6 Description An authenticated attacker can inject arbitrary workout log entries into another user's SlotEntry by providing the victim's slot entry ID in a POST /api/v2/workoutlog/ request. This occurs because the slot...

CVE-2026-43976

creationtimestamp| type| source ---|---|--- 2026-10-04 17:38:27+00:00| published-proof-of-concept| https://github.com/wger-project/wger/security/advisories/GHSA-c72h-82w6-rqfp...

CVE-2026-46438

creationtimestamp| type| source ---|---|--- 2026-10-04 17:21:13+00:00| published-proof-of-concept| https://github.com/wger-project/wger/security/advisories/GHSA-rjpf-7pf5-q54x...

CVE-2026-46434

creationtimestamp| type| source ---|---|--- 2026-10-04 17:18:55+00:00| published-proof-of-concept| https://github.com/wger-project/wger/security/advisories/GHSA-x249-cx55-2h87...

CVE-2026-86255

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the datesequence computation via routine detail endpoints, forcing the server to iterate thousands of times per...

CVE-2026-86254

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the issamegym helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user...