CVE-2026-86254

wger (gym management platform) contains an incomplete authorization bypass in wger/core/views/user.py. Three views retain a raw integer comparison for the gym-scope check instead of the is_same_gym() helper, creating a None != None edge case . An attacker with gym.manage_gym permission and a gym=...