Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management via UserDeactivateView and UserActivateView in wger/core/views/user.py, where WgerMultiplePermissionRequiredMixin applies OR logic to the permissionrequired tuple, granting any user holding the gym.gymtrain...