CVE-2026-43978: wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
(updated )
A gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity
is set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.
References
- github.com/advisories/GHSA-9qpr-vc49-hqg2
- github.com/pypa/advisory-database/tree/main/vulns/wger/PYSEC-2026-3420.yaml
- github.com/wger-project/wger
- github.com/wger-project/wger/commit/19c97822492f9914ccfcebeeda319be4e7562790
- github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2
- nvd.nist.gov/vuln/detail/CVE-2026-43978
- pypi.org/project/wger
Code Behaviors & Features
Detect and mitigate CVE-2026-43978 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →