CVE-2026-43976: Wger-Project Wger

High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days.

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed. Version 2.6 fixes the issue.

Affected products

• Wger-Project Wger: before 2.6 (fixed in 2.6)

Published 2026-10-07. Last modified 2026-10-07.