Is CVE-2026-86254 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86254 being exploited in the wild.

How severe is CVE-2026-86254?

Medium severity, with a CVSS score of 6.8, published 6 September 2026.

Which products and versions are affected?

wger project wger through master (as of 2026-05-08).

Is there a fix for CVE-2026-86254?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86254 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86254?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86254: wger incomplete authorization bypass in user management views

CVE-2026-86254 · Severity: medium · CVSS 6.8 · Published 2026-09-06

wger is a Django-based fitness management and tracking platform. An incomplete authorization fix allows gym staff members with administrative permissions but no assigned gym affiliation to delete user accounts, lock users out by deactivating them, or reactivate deactivated users across the entire system. This bypasses the intended tenant isolation controls, enabling account takeover and denial of service against other users.

Quick answers

Is CVE-2026-86254 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86254 being exploited in the wild.
How severe is CVE-2026-86254?: Medium severity, with a CVSS score of 6.8, published 6 September 2026.
Which products and versions are affected?: wger project wger through master (as of 2026-05-08).
Is there a fix for CVE-2026-86254?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86254 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86254?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in wger/core/views/user.py where three views (UserDeactivateView, UserActivateView, and delete) use raw integer comparison (gym_id != ...) instead of the corrected is_same_gym() helper function to enforce gym-scope boundaries. The root cause is a failed patch: a prior fix (CVE-2026-43948) added is_same_gym() to five views in wger/gym/views/ but left three views in wger/core/views/user.py unpatched. The bug exploits Python's None != None evaluation returning False, allowing users with gym=None (default unassigned state) and gym.manage_gym permission to bypass the authorization check and perform write operations on any other user with gym=None. An attacker can permanently delete accounts, deactivate users (locking them out), or reactivate deactivated users. User enumeration is trivial via sequential primary keys. No patch is currently available for the affected views.

Affected products

wger project wger through master (as of 2026-05-08)

Timeline

2026-09-06: disclosed: CVE-2026-86254 published by NVD
2026-05-14: advisory: GHSA-mw8f-w6p8-xrf4 published; incomplete fix discovered
2026-04-28: other: Prior incomplete fix (CVE-2026-43948 / GHSA-mhc8-p3jx-84mm) patched five of eight affected views

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.