wger Cross-Tenant Password Reset & Plaintext Disclosure CVE-2025-43948

wger Cross-Tenant Password Reset and Plaintext Disclosure Vulnerability Summary Vulnerability Overview Vulnerability Name: wger: cross-tenant password reset and plaintext disclosure via bypass CVE ID: CVE-2025-43948 CVSS Score: 9.0 (Critical) Release Date: 3 weeks ago Core Issue: In the and views of , there is a security logic flaw based on Python object identity comparison ( ). When the attribute of both the attacker and the victim is , the expression evaluates to , causing the permission check to be bypassed. Attack Impact: 1. An attacker with permissions can reset the password of any other user. 2. The new password is returned in plaintext within the HTTP response body. 3. The attacker can log in to the victim's account using the new password. 4. The victim's original password is permanently invalidated, resulting in permanent lockout. Scope of Impact Affected Versions: = 2.6 Affected Endpoints: -> -> Affected Scenarios: Any deployment where permissions are delegated to non-admin users, and other users exist with . is the default state for new users before manual gym assignment. Remediation Recommended Patch: Replace the object identity check ( ) with a value comparison ( ), and explicitly handle the case. Explanation: Access the raw foreign key integer value using the suffix to avoid Python object identity semantics issues. Explicitly deny unauthorized trainers regardless of the status. This fix also applies to other views such as , , and . POC Code Step 1: Authenticate as trainer with manage_gym permission and gym=None Step 2: Trigger cross-tenant password reset Step 3: Authenticate as victim (alice) using leaked password RBAC Disproof Protocol (three-scenario test): Scenario A (admin, same-gym) -> HTTP 200 (expected - documented feature) Scenario B (trainer, gym=None -> alice gym=None) -> HTTP 200 with plaintext password in body (expected HTTP 403) Scenario C (trainer, gym=1 -> alice gym=2) -> HTTP 403 (expected - guard works when gyms differ, confirms bypass is None-specific) Reproducibility: 2/2 runs after clean-baseline database status.

Goal Reached Thanks to every supporter — we hit 100%!

wger Cross-Tenant Password Reset & Plaintext Disclosure CVE-2025-43948