CVE-2026-43978

Name of the Vulnerable Software and Affected Versions wger version 2.5.0a2

Description A logical error in the permission check allows an authenticated gym trainer to escalate privileges to a gym manager or general manager account. By chaining two calls to the trainer-login endpoint, a trainer can first switch to a low-privileged user, which sets the trainer.identity session flag. This flag subsequently bypasses the permission check on further calls to the trainer-login endpoint, enabling the attacker to take over higher-privileged accounts. This allows unauthorized access to member data, contract modifications, and gym configuration management.

Recommendations Update wger to a version that corrects the logical error in wger/core/views/user.py to ensure that the original trainer's permissions are verified and that target-user protection applies to both direct and chained login attempts. As a temporary mitigation, restrict access to the trainer-login endpoint to only trusted administrative users.