CVE-2026-43976: wger Cross-Tenant Admin Notes and Contracts Leak via Gym=None Bypass
Summary
CVE-2026-43976: wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views). Affects wger versions < 2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wger is an open-source gym management application that allows trainers to manage gym activities, user profiles, and administrative notes. It provides functionalities such as tracking user progress, managing contracts, and storing documents. However, due to a flaw in its permission checks, it is vulnerable to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability arises from a flawed gym-scope guard in five management views within wger, where the condition to check if two gyms are different fails when both are None. This allows an authenticated trainer with specific permissions but no gym assignment to access private admin notes, documents, contracts, and user configurations of any unaffiliated user. The lack of proper validation leads to significant confidentiality loss, as sensitive information can be accessed without appropriate authorization.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that no users are assigned a gym=None status until the vulnerability is patched. This can be done by manually assigning all users to a gym to prevent unauthorized access.
Conclusion
The CVE-2026-43976 vulnerability in wger poses a significant risk to user privacy and data security. It is crucial for administrators to update to the patched version of the software and implement the suggested fixes to mitigate the risk of unauthorized data access.
See every vulnerability recorded for wger →
FAQ
CVE-2026-43976 is a vulnerability in the wger gym management application that allows unauthorized access to sensitive information due to a flawed gym-scope guard.
Any wger instance where trainers have the permissions 'gym.gym_trainer' and 'gym.add_adminusernote' and where users exist with 'gym=None' are affected.
An attacker can access private admin notes, documents, contracts, user configurations, and potentially modify user permissions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for wger.
