CVE-2026-43976.

Disclosure summary

### Summary Five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed. ### Details **Files**: `wger/gym/views/user.py`, `wger/gym/views/admin_notes.py`, `wger/gym/views/document.py`, `wger/gym/views/contract.py`, `wger/gym/views/user_config.py` The same flawed comparison pattern appears across at least five views: ```python # VULNERABLE - applied in admin_notes_list, documents_list, contracts_list, # user_config, and gym_permissions_user_edit if request.user.userprofile.gym != user.userprofile.gym: return HttpResponseForbidden() # After the guard (admin notes example): notes = AdminUserNote.objects.filter(member=member) # only filtered by member_id ``` When both `request.user.userprofile.gym` and `

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

Original records & references

• NIST NVD record
• CVE Program record
• github.com — Reviewed advisory

PUBLISHED 2026-10-07T09:33:14-04:00
MODIFIED 2026-10-07T09:33:14-04:00
INGESTED 2026-10-08T12:05:11-04:00