# CVE-2026-43978: wger privilege escalation in trainer-login session chaining

Source: https://junglewise.ai/threats/cve-2026-43978-wger-privilege-escalation-in-trainer-login-session-chaining  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-43978 · Severity: high · CVSS 8.1 · Published 2026-07-16

wger is an open-source fitness and workout management platform. A security flaw in the trainer login system allows a gym trainer to escalate their privileges to a gym manager or general manager account. By exploiting this, a trainer could gain full administrative control, allowing them to view sensitive member data, modify contracts, and access personal information of other staff members.

Technologies: [wger (PyPI)](https://junglewise.ai/threats/technologies/wger). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-43978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43978 being exploited in the wild.

**How severe is CVE-2026-43978?** High severity, with a CVSS score of 8.1, published 16 July 2026.

**Which products and versions are affected?** wger (PyPI) <= 2.5, ECOSYSTEM:introduced=0,last_affected=2.5.

**Is there a fix for CVE-2026-43978?** A patch was published on 2026-07-16: Fix confirmed in version 2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43978 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-43978?** Check whether you run wger (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in wger/core/views/user.py due to improper session flag validation in the trainer-login endpoint. The application uses a logical 'AND' condition to check for the 'gym.gym_trainer' permission and the 'trainer.identity' session flag; however, once a trainer successfully switches to a low-privileged user, the presence of the 'trainer.identity' flag causes the permission check to short-circuit. An attacker with trainer-level access can first switch to a regular user and then perform a second 'hop' to a manager account because the secondary protection block only triggers if the current user (now a regular user) holds trainer permissions. This allows an authenticated attacker to impersonate any higher-privileged user within the same gym. The issue is resolved in version 2.6 by ensuring the original trainer's permissions are verified during chained session hops.

## Affected products

- wger-project wger < 2.6

## Identifiers

- CVE-2026-43978
- GHSA-9qpr-vc49-hqg2
- PYSEC-2026-3420

## Timeline

- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD
- 2026-07-16: patched: Fix confirmed in version 2.6

## References

- [https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2](https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2)

## Related threats

- [wger authorization bypass in workout log entry creation](https://junglewise.ai/threats/cve-2026-46438-wger-cross-user-data-corruption-via-missing-ownership-check-on)
- [wger Trainer privilege escalation in user deactivation](https://junglewise.ai/threats/cve-2026-46434-wger-trainer-privilege-escalation-improper-privilege-management)
- [wger API credentials remain valid after logout/password change](https://junglewise.ai/threats/cve-2026-46437-wger-api-credentials-remain-valid-after-logout-password-change)
- [wger trainer_login CSRF bypass via GET request](https://junglewise.ai/threats/cve-2026-45161-wger-trainer-login-accepts-get-csrf-bypass-enables-forced-session)
- [wger gym-scope guard bypass allows cross-tenant admin notes leak](https://junglewise.ai/threats/cve-2026-43976-wger-cross-tenant-admin-notes-contracts-leak-via-gym-none-bypass)