wger: Trainer Privilege Escalation through Improper Privilege Management
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.
Summary
wger, a free open-source workout and fitness manager, lets a user with only the gym_trainer permission deactivate any account in the same gym, including gym_manager and general_gym_manager accounts, in versions before 2.6. This is CWE-269, Improper Privilege Management. UserDeactivateView admits anyone holding gym.manage_gym, gym.manage_gyms or gym.gym_trainer, because WgerMultiplePermissionRequiredMixin uses OR logic, and it performs no privilege-hierarchy check, so a lower-privileged role can disable a higher-privileged one. The CVSS 3.1 base score is 7.1 (HIGH).
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding any one of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wger-project | wger | before 2.6 | 2.6 | Patch available | CNA |
| — | wger (PyPI) | up to 2.1 | — | No fix listed | GHSA-x249-cx55-2h87 |
- wger Vendorwger-project Affected before 2.6 Fixed in 2.6 Patch available CNA
- wger (PyPI) Vendor— Affected up to 2.1 Fixed in — No fix listed GHSA-x249-cx55-2h87
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* | — | — | wger-project |
- cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* Versions — — ·wger-project
Remediation
Upgrade wger to version 2.6, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA wger (wger-project) Fixed in 2.6
Timeline
- 2026-10-07 Threatist record created from CVE-2026-46434
- 2026-10-07 Alias added: GHSA-x249-cx55-2h87
- 2026-10-07 Affected versions changed · GHSA-x249-cx55-2h87
- 2026-10-07 CVSS score added · GHSA-x249-cx55-2h87
- 2026-10-07 Weakness changed · GHSA-x249-cx55-2h87
- 2026-10-07 3 new references · GHSA-x249-cx55-2h87
- 2026-10-07 CISA SSVC decision points changed
References
Other 6
- https://github.com/wger-project/wger/security/advisories/GHSA-x249-cx55-2h87
- https://github.com/wger-project/wger/releases/tag/2.6
- https://github.com/wger-project/wger/commit/9be2d5f2b4559f9a9d5b3f3b3cdadcfef449f645
- https://github.com/pypa/advisory-database/tree/main/vulns/wger/PYSEC-2026-4316.yaml
- https://github.com/wger-project/wger
- https://pypi.org/project/wger
More wger-project vulnerabilities
- TI-2026-32005 wger: cross-tenant password reset and plaintext disclosure via gym=None bypass CVSS 3.1CRITICAL 9.9
- TI-2022-02450 Improper Restriction of Excessive Authentication Attempts in wger-project/wger CVSS 3.1CRITICAL 9.8
- TI-2023-20093 Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager… CVSS 3.1HIGH 8.8
- TI-2026-32021 wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API CVSS 3.1HIGH 7.5
- TI-2026-32022 wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers CVSS 3.1HIGH 8.1
- TI-2026-29226 wger has Broken Access Control in the Global Gym Configuration Update Endpoint CVSS 3.1HIGH 7.6
Sources
- CVE-2026-46434 · CVE Program
- CVE-2026-46434 · NVD
- FIRST EPSS
- GHSA-x249-cx55-2h87 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences