https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 15:30:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338382 EUVD-2026-338382 https://cve.radiocsirt.org/vuln/euvd-2026-338382 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43978 <p>wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers&#39; and managers&#39; personal information. This issue has been fixed in version 2.6.</p> <p>wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers&#39; and managers&#39; personal information. This issue has been fixed in version 2.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43978 https://cve.radiocsirt.org/vuln/ghsa-9qpr-vc49-hqg2 <p><strong>Affected:</strong> PyPI: wger</p> <p>### Summary A gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag `trainer.identity` is set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.</p> <p>### Details In `wger/core/views/user.py` lines 169–178, the permission check uses an AND condition:</p> <p>```python # Line 169 — passes if EITHER condition is false if not request.user.has_perm(&#39;gym.gym_trainer&#39;) and not request.session.get(&#39;trainer.identity&#39;): return HttpResponseForbidden()</p> <p># Line 173 — only runs when current user IS a trainer, not when identity is inherited if request.user.has_perm(&#39;gym.gym_trainer&#39;) and ( user.has_perm(&#39;gym.manage_gym&#39;) or user.has_perm(&#39;gym.manage_gyms&#39;) ): return HttpResponseForbidden() ```</p> <p>After hop 1 (trainer → regular user), `request.user` is the regular user who has no `gym_trainer` permission, but `session[&#39;trainer.identity&#39;]` is set. Line 169 evaluates: `not False AND not False` → the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.</p> <p>### PoC Requirements: A running wger instance with at least one gym trainer account and one…</p> <p><strong>Affected:</strong> PyPI: wger</p> <p>### Summary A gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag `trainer.identity` is set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.</p> <p>### Details In `wger/core/views/user.py` lines 169–178, the permission check uses an AND condition:</p> <p>```python # Line 169 — passes if EITHER condition is false if not request.user.has_perm(&#39;gym.gym_trainer&#39;) and not request.session.get(&#39;trainer.identity&#39;): return HttpResponseForbidden()</p> <p># Line 173 — only runs when current user IS a trainer, not when identity is inherited if request.user.has_perm(&#39;gym.gym_trainer&#39;) and ( user.has_perm(&#39;gym.manage_gym&#39;) or user.has_perm(&#39;gym.manage_gyms&#39;) ): return HttpResponseForbidden() ```</p> <p>After hop 1 (trainer → regular user), `request.user` is the regular user who has no `gym_trainer` permission, but `session[&#39;trainer.identity&#39;]` is set. Line 169 evaluates: `not False AND not False` → the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.</p> <p>### PoC Requirements: A running wger instance with at least one gym trainer account and one…</p> https://cve.radiocsirt.org/vuln/ghsa-9qpr-vc49-hqg2 https://cve.radiocsirt.org/vuln/pysec-2026-3420 <p><strong>Affected:</strong> PyPI: wger</p> <p>### Summary A gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag `trainer.identity` is set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.</p> <p>### Details In `wger/core/views/user.py` lines 169–178, the permission check uses an AND condition:</p> <p>```python # Line 169 — passes if EITHER condition is false if not request.user.has_perm(&#39;gym.gym_trainer&#39;) and not request.session.get(&#39;trainer.identity&#39;): return HttpResponseForbidden()</p> <p># Line 173 — only runs when current user IS a trainer, not when identity is inherited if request.user.has_perm(&#39;gym.gym_trainer&#39;) and ( user.has_perm(&#39;gym.manage_gym&#39;) or user.has_perm(&#39;gym.manage_gyms&#39;) ): return HttpResponseForbidden() ```</p> <p>After hop 1 (trainer → regular user), `request.user` is the regular user who has no `gym_trainer` permission, but `session[&#39;trainer.identity&#39;]` is set. Line 169 evaluates: `not False AND not False` → the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.</p> <p>### PoC Requirements: A running wger instance with at least one gym trainer account and one…</p> <p><strong>Affected:</strong> PyPI: wger</p> <p>### Summary A gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag `trainer.identity` is set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.</p> <p>### Details In `wger/core/views/user.py` lines 169–178, the permission check uses an AND condition:</p> <p>```python # Line 169 — passes if EITHER condition is false if not request.user.has_perm(&#39;gym.gym_trainer&#39;) and not request.session.get(&#39;trainer.identity&#39;): return HttpResponseForbidden()</p> <p># Line 173 — only runs when current user IS a trainer, not when identity is inherited if request.user.has_perm(&#39;gym.gym_trainer&#39;) and ( user.has_perm(&#39;gym.manage_gym&#39;) or user.has_perm(&#39;gym.manage_gyms&#39;) ): return HttpResponseForbidden() ```</p> <p>After hop 1 (trainer → regular user), `request.user` is the regular user who has no `gym_trainer` permission, but `session[&#39;trainer.identity&#39;]` is set. Line 169 evaluates: `not False AND not False` → the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.</p> <p>### PoC Requirements: A running wger instance with at least one gym trainer account and one…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3420