Junglewise Threat Intelligence

wger cross-tenant account deletion and deactivation in core user views

Severity: high · CVSS 8.5 · Published 2026-05-20

Technologies: Wger-Project Wger. Vendors: PyPI.

Executive brief

wger is a fitness and gym management application. A vulnerability exists where gym staff members with specific management permissions can delete, deactivate, or reactivate user accounts they should not have access to. This could lead to permanent loss of customer data (workouts, nutrition plans, contracts) and service outages for affected users.

Technical details

This is an incomplete-fix variant of CVE-2026-43948. While several views were migrated to use a safe 'is_same_gym' helper, three views in 'wger/core/views/user.py' (delete, UserDeactivateView, and UserActivateView) still use raw integer comparisons for gym IDs. When both an attacker (with 'gym.manage_gym' permissions) and a victim have no assigned gym (gym_id is None), the comparison 'None != None' evaluates to False, bypassing the intended gym-scope authorization guard. An attacker can enumerable victim IDs and permanently delete accounts or lock users out. The deletion occurs even if the application subsequently returns a 500 error during redirection.

Affected products

  • wger-project wger <= 2.5

Timeline

  • 2026-05-08: other: Vulnerability confirmed on latest Docker build
  • 2026-05-14: disclosed
  • 2026-05-20: advisory

References

Related threats