CVE-2026-46434 wger: Trainer Privilege Escalation - Improper Privilege Management

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gymtrainer permission can deactivate any account in the same gym, including gymmanager and generalgymmanager accounts. The UserDeactivateView grants access to anyone holding any one of gym.managegy...

CVE-2026-46434

The fitness manager wger is vulnerable to a privilege escalation flaw in versions prior to 2.6 due to improper permission management (CWE-269 ). The UserDeactivateView (and UserActivateView) allows any user with the gym.gym_trainer permission to deactivate any account within the same gym, includi...

CVE-2026-86254: Missing Authorization

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the issamegym helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user...