wger CVE-2026-43978

Exploitation requires: (1) Valid authenticated gym trainer account ('gym.gym_trainer' permission) in the target wger instance. (2) Existence of at least one gym manager or general manager account within the same gym organization (target user must have 'gym.manage_gym' or 'gym.manage_gyms' permissions). (3) Knowledge of target manager's user primary key (ID) - obtainable via API enumeration (/api/v2/userprofile/) or predictable integer PKs. (4) Network access to the wger application HTTP interface (AV:N). No special configuration required beyond default wger multi-user gym setup. Attack does NOT require: non-default features, user interaction (UI:N), or elevated privileges beyond standard trainer role (PR:L). Limiting factors: attacker must already possess or compromise a trainer account (insider threat or credential theft scenario); exploitation is scoped to accounts within the same gym (multi-gym deployments partially compartmentalize risk). The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U confirms network-accessible exploitation against default configurations requiring only low-privilege authenticated access.

Real-world risk is HIGH for multi-tenant wger deployments. CVSS 8.1 reflects: AV:N (network-exploitable via HTTP), AC:L (trivial logic flaw), PR:L (requires low-privilege gym trainer account), UI:N (no user interaction), S:U (scope unchanged - compromise stays within wger application), C:H+I:H (full read/write access to gym data), A:N (no availability impact). GitHub advisory includes a working proof-of-concept requiring only HTTP requests and valid trainer credentials. Attack complexity is extremely low - PoC is 30 lines of Python using standard requests library. No authentication beyond initial gym trainer access is needed, making this exploitable by any insider with trainer role. EPSS data is unavailable, preventing statistical risk comparison, but PoC availability and insider-threat scenario (disgruntled staff, social-engineered accounts) drive up likelihood. Not in CISA KEV, indicating no widespread exploitation detected, though this is a new disclosure (CVE-2026 series suggests recent assignment). Scope is unchanged (S:U) - the attacker remains within the wger application but gains manager-level access to sensitive member health data, payment information, and gym operations. SSVC framework indicates: Exploitation=POC, Automatable=Yes (chained HTTP calls), Technical Impact=Total (within gym context). Deployment-specific risk multiplier: organizations with weak trainer account vetting or shared trainer credentials face higher exposure. Key missing data: patch release timeline and affected version granularity (advisory states ≤2.5 but no precise lower bound). No evidence of active exploitation, but the trivial PoC and insider-access vector mean defenders should treat this as immediately actionable.

An authenticated gym trainer (e.g., recently hired staff or contractor with standard trainer credentials) first performs a legitimate session switch into a low-privilege gym member account using the trainer-login endpoint - this sets the trainer.identity session flag. The attacker then immediately calls trainer-login again, this time targeting a gym manager account (user ID enumerable via /api/v2/userprofile/ or predictable incremental PKs). The flawed permission check at line 169 evaluates the session flag alone and bypasses authorization, granting the trainer full manager session access. The attacker now views all member PII (health data, payment info), modifies gym contracts, reconfigures access permissions, or exfiltrates member databases via API endpoints. Publicly available proof-of-concept from GitHub advisory demonstrates end-to-end exploitation requiring only HTTP library and valid trainer login.