Authorization Bypass in wger Gym Management System

Executive Summary

CVE-2026-86254 is a medium-severity vulnerability in wger fitness management software affecting versions up to master. It involves incomplete authorization in wger/core/views/user.py where three views use raw integer comparison instead of the is_same_gym() helper function. This allows gym staff with gym=None affiliation and gym.manage_gym permission to bypass checks and perform unauthorized actions on other users with gym=None.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the wger/core/views/user.py file for improper integer comparisons (e.g., gym_id != request.user.userprofile.gym_id) instead of using the is_same_gym() helper function. Check for users with gym=None and gym.manage_gym permission who can perform unauthorized actions on other gym=None users.

Useful 0 Not Useful 0

Impact Analysis

Attackers with gym.manage_gym permission and gym=None can permanently delete user accounts, deactivate accounts to lock users out, or reactivate deactivated accounts. This leads to data loss (workouts, weight history, nutrition plans), service disruption, and potential privilege escalation. Exploitation requires only user ID enumeration and triggering affected endpoints.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability could violate GDPR's data protection requirements by enabling unauthorized account deletion and data loss. For HIPAA, it risks exposing protected health information through unauthorized account manipulation. Compliance impact depends on data sensitivity and organizational controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update wger to a patched version that replaces raw integer comparisons with the is_same_gym() helper in wger/core/views/user.py. Ensure no users with gym=None have gym.manage_gym permission. Review logs for unauthorized deactivation, activation, or deletion attempts targeting users with gym=None.

Useful 0 Not Useful 0