{"items":[{"id":"NVI-00010627","kind":"vulnerability","title":"wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-c72h-82w6-rqfp","CVE-2026-43976"],"plain_summary":"GitHub lists this reviewed advisory for wger. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1a305106fae6b81f7ce511510e19932c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T15:50:10.000Z","value":"7.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-742e80334b731e9e5b4064d2ed38ed2d"},{"kind":"CVSS","as_of":"2026-10-07T18:17:20.770Z","value":"7.1 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-37757c4a1b617e240d749c96264fdd50"},{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.219%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.1252. Missing scores are unknown.","source_id":"sr-1a305106fae6b81f7ce511510e19932c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-742e80334b731e9e5b4064d2ed38ed2d","url":"https://github.com/advisories/GHSA-c72h-82w6-rqfp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c72h-82w6-rqfp","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:46.371Z"},{"id":"sr-37757c4a1b617e240d749c96264fdd50","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43976","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-43976","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T22:35:12.981Z"},{"id":"sr-1a305106fae6b81f7ce511510e19932c","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-43976","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:44:07.785Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-742e80334b731e9e5b4064d2ed38ed2d"],"technology":"wger","known_exclusions":[],"conditions_summary":"### Summary\n\nFive gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed.\n\n### Details\n\n**Files**: `wger/gym/views/user.py`, `wger/gym/views/admin_notes.py`, `wger/gym/views/document.py`, `wger/gym/views/contract.py`, `wger/gym/views/user_config.py`\n\nThe same flawed comparison pattern appears across at least five views:\n\n```python\n# VULNERABLE - applied in admin_notes_list, documents_list, contracts_list,\n#              user_config, and gym_permissions_user_edit\nif request.user.userprofile.gym != user.userprofile.gym:\n    return HttpResponseForbidden()\n\n# After the guard (admin notes example):\nnotes = AdminUserNote.objects.filter(member=member)  # only filtered by member_id\n```\n\nWhen both `request.us","public_affected_ranges":["<= 2.1"]}],"null_published_at":"2026-11-07T14:01:55.390Z","source_updated_at":"2026-10-26T15:50:10.000Z","source_disclosed_at":"2026-10-07T13:33:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T22:06:46.371Z"},{"id":"NVI-00010627","kind":"vulnerability","title":"wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-c72h-82w6-rqfp","CVE-2026-43976"],"plain_summary":"GitHub lists this reviewed advisory for wger. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-27a93c69e276204241834515fb669a9c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T15:50:10.000Z","value":"7.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-742e80334b731e9e5b4064d2ed38ed2d"},{"kind":"CVSS","as_of":"2026-10-07T18:17:20.770Z","value":"7.1 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-37757c4a1b617e240d749c96264fdd50"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.219%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.12483. Missing scores are unknown.","source_id":"sr-27a93c69e276204241834515fb669a9c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-742e80334b731e9e5b4064d2ed38ed2d","url":"https://github.com/advisories/GHSA-c72h-82w6-rqfp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c72h-82w6-rqfp","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:46.371Z"},{"id":"sr-37757c4a1b617e240d749c96264fdd50","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43976","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-43976","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T22:35:12.981Z"},{"id":"sr-27a93c69e276204241834515fb669a9c","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-43976","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.279Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-742e80334b731e9e5b4064d2ed38ed2d"],"technology":"wger","known_exclusions":[],"conditions_summary":"### Summary\n\nFive gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed.\n\n### Details\n\n**Files**: `wger/gym/views/user.py`, `wger/gym/views/admin_notes.py`, `wger/gym/views/document.py`, `wger/gym/views/contract.py`, `wger/gym/views/user_config.py`\n\nThe same flawed comparison pattern appears across at least five views:\n\n```python\n# VULNERABLE - applied in admin_notes_list, documents_list, contracts_list,\n#              user_config, and gym_permissions_user_edit\nif request.user.userprofile.gym != user.userprofile.gym:\n    return HttpResponseForbidden()\n\n# After the guard (admin notes example):\nnotes = AdminUserNote.objects.filter(member=member)  # only filtered by member_id\n```\n\nWhen both `request.us","public_affected_ranges":["<= 2.1"]}],"null_published_at":"2026-11-06T15:18:11.437Z","source_updated_at":"2026-10-26T15:50:10.000Z","source_disclosed_at":"2026-10-07T13:33:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T22:06:46.371Z"},{"id":"NVI-00010627","kind":"vulnerability","title":"wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-c72h-82w6-rqfp","CVE-2026-43976"],"plain_summary":"GitHub lists this reviewed advisory for wger. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-37757c4a1b617e240d749c96264fdd50"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T15:50:10.000Z","value":"7.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-742e80334b731e9e5b4064d2ed38ed2d"},{"kind":"CVSS","as_of":"2026-10-07T18:17:20.770Z","value":"7.1 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-37757c4a1b617e240d749c96264fdd50"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-742e80334b731e9e5b4064d2ed38ed2d","url":"https://github.com/advisories/GHSA-c72h-82w6-rqfp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c72h-82w6-rqfp","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:46.371Z"},{"id":"sr-37757c4a1b617e240d749c96264fdd50","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43976","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-43976","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T22:35:12.981Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-742e80334b731e9e5b4064d2ed38ed2d"],"technology":"wger","known_exclusions":[],"conditions_summary":"### Summary\n\nFive gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed.\n\n### Details\n\n**Files**: `wger/gym/views/user.py`, `wger/gym/views/admin_notes.py`, `wger/gym/views/document.py`, `wger/gym/views/contract.py`, `wger/gym/views/user_config.py`\n\nThe same flawed comparison pattern appears across at least five views:\n\n```python\n# VULNERABLE - applied in admin_notes_list, documents_list, contracts_list,\n#              user_config, and gym_permissions_user_edit\nif request.user.userprofile.gym != user.userprofile.gym:\n    return HttpResponseForbidden()\n\n# After the guard (admin notes example):\nnotes = AdminUserNote.objects.filter(member=member)  # only filtered by member_id\n```\n\nWhen both `request.us","public_affected_ranges":["<= 2.1"]}],"null_published_at":"2026-11-04T10:04:35.931Z","source_updated_at":"2026-10-26T15:50:10.000Z","source_disclosed_at":"2026-10-07T13:33:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T22:06:46.371Z"},{"id":"NVI-00010627","kind":"vulnerability","title":"wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c72h-82w6-rqfp","CVE-2026-43976"],"plain_summary":"GitHub lists this reviewed advisory for wger. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-742e80334b731e9e5b4064d2ed38ed2d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T15:50:10.000Z","value":"7.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-742e80334b731e9e5b4064d2ed38ed2d"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-742e80334b731e9e5b4064d2ed38ed2d","url":"https://github.com/advisories/GHSA-c72h-82w6-rqfp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c72h-82w6-rqfp","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:46.371Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-742e80334b731e9e5b4064d2ed38ed2d"],"technology":"wger","known_exclusions":[],"conditions_summary":"### Summary\n\nFive gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed.\n\n### Details\n\n**Files**: `wger/gym/views/user.py`, `wger/gym/views/admin_notes.py`, `wger/gym/views/document.py`, `wger/gym/views/contract.py`, `wger/gym/views/user_config.py`\n\nThe same flawed comparison pattern appears across at least five views:\n\n```python\n# VULNERABLE - applied in admin_notes_list, documents_list, contracts_list,\n#              user_config, and gym_permissions_user_edit\nif request.user.userprofile.gym != user.userprofile.gym:\n    return HttpResponseForbidden()\n\n# After the guard (admin notes example):\nnotes = AdminUserNote.objects.filter(member=member)  # only filtered by member_id\n```\n\nWhen both `request.us","public_affected_ranges":["<= 2.1"]}],"null_published_at":"2026-10-31T22:27:09.626Z","source_updated_at":"2026-10-26T15:50:10.000Z","source_disclosed_at":"2026-10-07T13:33:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:06:46.371Z"}],"next_cursor":null,"snapshot_revision":"42594"}