PT-2026-107514

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6 Description A privilege management issue exists where a user with the gym trainer permission can deactivate any account within the same gym, including those with higher privileges such as gym manager and general gym...

GHSA-9QPR-VC49-HQG2 wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager

Summary A gym trainer can escalate their session to any higher-privileged account gym manager, general manager by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone...