Executive brief
wger is a fitness and gym management application. A vulnerability exists where gym staff members with specific management permissions can delete, deactivate, or reactivate user accounts they should not have access to. This could lead to permanent loss of customer data (workouts, nutrition plans, contracts) and service outages for affected users.
Technical details
This is an incomplete-fix variant of CVE-2026-43948. While several views were migrated to use a safe 'is_same_gym' helper, three views in 'wger/core/views/user.py' (delete, UserDeactivateView, and UserActivateView) still use raw integer comparisons for gym IDs. When both an attacker (with 'gym.manage_gym' permissions) and a victim have no assigned gym (gym_id is None), the comparison 'None != None' evaluates to False, bypassing the intended gym-scope authorization guard. An attacker can enumerable victim IDs and permanently delete accounts or lock users out. The deletion occurs even if the application subsequently returns a 500 error during redirection.
Affected products
- wger-project wger <= 2.5
Timeline
- 2026-05-08: other: Vulnerability confirmed on latest Docker build
- 2026-05-14: disclosed
- 2026-05-20: advisory
References
- https://api.github.com/users/HiyokoSauna37
- https://github.com/HiyokoSauna37
- https://api.github.com/users/HiyokoSauna37/gists%7B/gist_id%7D
- https://api.github.com/users/HiyokoSauna37/repos
- https://avatars.githubusercontent.com/u/263803677?v=4
- https://api.github.com/users/HiyokoSauna37/events%7B/privacy%7D