GHSA-X249-CX55-2H87 wger: Trainer Privilege Escalation - Improper Privilege Management

Summary A user with only the gymtrainer permission can deactivate any account in the same gym, including gymmanager and generalgymmanager accounts. The UserDeactivateView grants access to anyone holding any one of gym.managegym, gym.managegyms, or gym.gymtrainer OR logic via...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management via UserDeactivateView and UserActivateView in wger/core/views/user.py, where WgerMultiplePermissionRequiredMixin applies OR logic to the permissionrequired tuple, granting any user holding the gym.gymtrain...

wger: Trainer Privilege Escalation - Improper Privilege Management

Summary A user with only the gymtrainer permission can deactivate any account in the same gym, including gymmanager and generalgymmanager accounts. The UserDeactivateView grants access to anyone holding any one of gym.managegym, gym.managegyms, or gym.gymtrainer OR logic via...