CVE-2026-43978: wger privilege escalation in trainer-login session chaining

CVE-2026-43978 · Severity: high · CVSS 8.1 · Published 2026-07-16

wger is an open-source fitness and workout management platform. A security flaw in the trainer login system allows a gym trainer to escalate their privileges to a gym manager or general manager account. By exploiting this, a trainer could gain full administrative control, allowing them to view sensitive member data, modify contracts, and access personal information of other staff members.

Technologies: wger (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-43978 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43978 being exploited in the wild.
How severe is CVE-2026-43978?
High severity, with a CVSS score of 8.1, published 16 July 2026.
Which products and versions are affected?
wger (PyPI) <= 2.5, ECOSYSTEM:introduced=0,last_affected=2.5.
Is there a fix for CVE-2026-43978?
A patch was published on 2026-07-16: Fix confirmed in version 2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43978 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-43978?
Check whether you run wger (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in wger/core/views/user.py due to improper session flag validation in the trainer-login endpoint. The application uses a logical 'AND' condition to check for the 'gym.gym_trainer' permission and the 'trainer.identity' session flag; however, once a trainer successfully switches to a low-privileged user, the presence of the 'trainer.identity' flag causes the permission check to short-circuit. An attacker with trainer-level access can first switch to a regular user and then perform a second 'hop' to a manager account because the secondary protection block only triggers if the current user (now a regular user) holds trainer permissions. This allows an authenticated attacker to impersonate any higher-privileged user within the same gym. The issue is resolved in version 2.6 by ensuring the original trainer's permissions are verified during chained session hops.

Affected products

  • wger-project wger < 2.6

Identifiers

  • CVE-2026-43978
  • GHSA-9qpr-vc49-hqg2
  • PYSEC-2026-3420

Timeline

  • 2026-05-14: advisory: GitHub Security Advisory published
  • 2026-07-16: disclosed: CVE published to NVD
  • 2026-07-16: patched: Fix confirmed in version 2.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.