PYSEC-2026-4313 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

Summary Five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment gym=None can read private admin notes, uploaded documents, gym contracts...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via a flawed gym-scope guard in five gym management views wger/gym/views/adminnotes.py, wger/gym/views/document.py, wger/gym/views/contract.py, wger/gym/views/userconfig.py, and wger/gym/views/user.py that compar...

CVE-2026-43976

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard "gyma != gymb" that silently passes when both operands are "None". A trainer with "gym.gymtrainer" and "gym.addadminusernote" permissions and no gym...

CVE-2026-43976: Incorrect Authorization

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...

PT-2026-107508

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6 Description Five gym management views contain a flawed gym-scope guard that fails when both compared operands are None. An authenticated trainer possessing gym.gym trainer and gym.add adminusernote permissions who is...