CVE-2026-86254: wger Incomplete Authorization Fix Cross-Tenant Account Deletion
wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the issamegym() helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user with gym=None. Attackers with gym.managegym permission and gym=None affiliation can permanently delete user accounts, lock users out via deactivation, or undo defensive deactivations by exploiting the None != None comparison edge case.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wgerto a version that resolves this vulnerability.Fixed in master - Configuration
Fix the incomplete authorization bypass by replacing the raw integer gym-scope comparison in the three affected views in wger/core/views/user.py with the is_same_gym() helper, so that staff with gym=None cannot delete/deactivate/activate users across other gyms with gym=None.
wger/core/views/user.py Gym-scope authorization check (None comparison) = Use the is_same_gym() helper instead of raw integer comparison for gym scoping in the affected user views
Event History
Frequently Asked Questions
Who is exposed to this authorization flaw?
The exposed population is users whose accounts have gym=None. A gym staff member who also has gym=None and the gym.manage_gym permission can target those accounts across the affected scope.
What access does an attacker need?
An attacker needs an authenticated account with the gym.manage_gym permission and no gym affiliation (gym=None). The issue is network-reachable but requires this privileged low-level access; no user interaction is required.
What actions can an attacker perform?
They can delete accounts permanently, deactivate accounts to lock users out, or reactivate accounts that were previously deactivated. The affected operations are the user delete, deactivate, and activate views.
How can administrators identify potentially vulnerable accounts and principals?
Review accounts with gym=None, then identify staff principals that both have gym=None and hold gym.manage_gym. Those principals can act on other gym=None accounts through the affected views.