CVE-2026-46434

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gymtrainer permission can deactivate any account in the same gym, including gymmanager and generalgymmanager accounts. The UserDeactivateView grants access to anyone holding any one of gym.managegy...

wger: Trainer Privilege Escalation - Improper Privilege Management

Summary A user with only the gymtrainer permission can deactivate any account in the same gym, including gymmanager and generalgymmanager accounts. The UserDeactivateView grants access to anyone holding any one of gym.managegym, gym.managegyms, or gym.gymtrainer OR logic via...

CVE-2026-46434

The fitness manager wger is vulnerable to a privilege escalation flaw in versions prior to 2.6 due to improper permission management (CWE-269 ). The UserDeactivateView (and UserActivateView) allows any user with the gym.gym_trainer permission to deactivate any account within the same gym, includi...

CVE-2026-46434 wger: Trainer Privilege Escalation - Improper Privilege Management

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gymtrainer permission can deactivate any account in the same gym, including gymmanager and generalgymmanager accounts. The UserDeactivateView grants access to anyone holding any one of gym.managegy...

CVE-2026-46434 wger: Trainer Privilege Escalation - Improper Privilege Management

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gymtrainer permission can deactivate any account in the same gym, including gymmanager and generalgymmanager accounts. The UserDeactivateView grants access to anyone holding any one of gym.managegy...