wger-project wger up to 2.5 Gym Scope Guard member_id privileges management

Summaryinfo

A vulnerability categorized as problematic has been discovered in wger-project wger up to 2.5. Affected is an unknown function of the component Gym Scope Guard. The manipulation of the argument member_id results in privileges management. This vulnerability is identified as CVE-2026-43976. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in wger-project wger up to 2.5. It has been classified as problematic. Affected is an unknown functionality of the component Gym Scope Guard. The manipulation of the argument member_id with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality. CVE summarizes:

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed. Version 2.6 fixes the issue.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-43976 since 05/04/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 2.6 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• wger-project

Name

• wger

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5

Website

• Product: https://github.com/wger-project/wger/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion