PT-2026-107514

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gym trainer permission can deactivate any account in the same gym, including gym manager and general gym manager accounts. The UserDeactivateView grants access to anyone holding any one of gym.mana...

GHSA-9QPR-VC49-HQG2 wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager

Summary A gym trainer can escalate their session to any higher-privileged account gym manager, general manager by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone...