CVE-2026-43948 — wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

Affected: wger-project wger

wger is a free, open-source workout and fitness manager. Prior to 2.6, the reset_user_password and gym_permissions_user_edit views in wger perform a gym-scope authorization check using Python object comparison (!=) that evaluates None != None as False, silently bypassing the guard when both the attacker and victim have no gym assignment (gym=None). A user with gym.manage_gym permission and gym=None can reset the password of any other gym=None user; the new plaintext password is returned verbatim in the HTML response body, enabling one-shot full account takeover. The victim's original password is invalidated, locking them out permanently. This vulnerability is fixed in 2.6.

PYSEC-2026-574 — wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

Affected: PyPI: wger

### Summary

The `reset_user_password` and `gym_permissions_user_edit` views in wger perform a gym-scope authorization check using Python object comparison (`!=`) that evaluates `None != None` as `False`, silently bypassing the guard when both the attacker and victim have no gym assignment (`gym=None`). A user with `gym.manage_gym` permission and `gym=None` can reset the password of **any other `gym=None` user**; the new plaintext password is returned verbatim in the HTML response body, enabling one-shot full account takeover. The victim's original password is invalidated, locking them out permanently.

### Details

**File**: `wger/gym/views/user.py`

The authorization guard in `reset_user_password` (and the parallel check in `gym_permissions_user_edit`) uses Django ORM object comparison:

```python # VULNERABLE - wger/gym/views/user.py if request.user.userprofile.gym != user.userprofile.gym: return HttpResponseForbidden() ```

When both `request.user.userprofile.gym` and `user.userprofile.gym` are `None` (representing users with no gym assignment - the default for newly registered users before gym linking), Python evaluates `None != None` as `False`. The guard therefore passes without raising `HttpResponseForbidden`, and execution continues unconditionally to:

```python password = password_generator() user.set_password(password) user.save() return render(request, 'user/trainer_login.html', {'password': password, ...}) ```

The generated password is rendered verbatim…

Most recent entries from all

CVE-2026-43948 — wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

PYSEC-2026-574 — wger: cross-tenant password reset and plaintext disclosure via gym=None bypass