PYSEC-2026-4313 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

Summary Five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment gym=None can read private admin notes, uploaded documents, gym contracts...