CVE-2026-43976: wger gym-scope guard bypass allows cross-tenant admin notes leak

CVE-2026-43976 · Severity: high · CVSS 7.1 · Published 2026-10-07

wger is a gym and fitness management web application. A trainer with limited permissions but no assigned gym can bypass access controls and read sensitive data (admin notes, contracts, documents, user config) for any other unaffiliated user on the instance. This allows disclosure of private employee salary data, medical records, disciplinary notes, and financial information across gym memberships.

Technologies: wger (PyPI), Wger. Vendors: PyPI, Wger.

Quick answers

Is CVE-2026-43976 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43976 being exploited in the wild.
How severe is CVE-2026-43976?
High severity, with a CVSS score of 7.1, published 7 October 2026.
Which products and versions are affected?
wger (PyPI) <= 2.1, ECOSYSTEM:introduced=0,last_affected=2.1; Wger all versions prior to fix.
Is there a fix for CVE-2026-43976?
No fixed version is recorded yet. Apply a shared helper function `assert_same_gym(trainer, member)` across all five affected views that explicitly checks `gym_id is not None` before comparison and adds secondary gym-scoped filters to all querysets to prevent drift. Restrict delegation of gym.gym_trainer and gym.add_adminusernote permissions to users with assigned gym values until patching.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-43976 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-43976?
Check whether you run wger (PyPI) or Wger at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Apply a shared helper function `assert_same_gym(trainer, member)` across all five affected views that explicitly checks `gym_id is not None` before comparison and adds secondary gym-scoped filters to all querysets to prevent drift. Restrict delegation of gym.gym_trainer and gym.add_adminusernote permissions to users with assigned gym values until patching.</anigation> </invoke>

Technical details

A flawed gym-scope guard in five views (admin_notes_list, documents_list, contracts_list, user_config, gym_permissions_user_edit) uses a direct object comparison (`gym_a != gym_b`) that silently passes when both operands are None. An authenticated trainer with gym.gym_trainer and gym.add_adminusernote permissions and gym=None assignment can bypass the check; subsequent querysets filter only on the attacker-supplied member_id with no secondary gym validation, disclosing all records. The fix requires explicit null checks and a secondary gym-scoped queryset filter.

Affected products

  • wger wger all versions prior to fix

Identifiers

  • CVE-2026-43976
  • GHSA-c72h-82w6-rqfp
  • PYSEC-2026-4313

Timeline

  • 2026-10-07: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.