wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

Summary Five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment gym=None can read private admin notes, uploaded documents, gym contracts...

CVE-2026-43976 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...

CVE-2026-43976

The wger fitness manager is vulnerable to a cross-tenant data leak in versions prior to 2.6 . A flaw in the gym-scope guard (gym_a != gym_b) allows it to silently pass when both operands are None. Consequently, a trainer with gym.gym_trainer and gym.add_adminusernote permissions but no gym assign...