Description

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user with gym=None. Attackers with gym.manage_gym permission and gym=None affiliation can permanently delete user accounts, lock users out via deactivation, or undo defensive deactivations by exploiting the None != None comparison edge case.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-06T12:17:16.297Z",
  "pubdate": "2026-09-06T12:17:16.297Z",
  "executiveSummary": "This vulnerability is an incomplete authorization bypass affecting multiple views within the wger/core/views/user.py module. The flaw stems from the use of insecure integer-based comparisons to validate gym-scope access permissions instead of utilizing the established is_same_gym() helper function.\nThe vulnerability allows authenticated attackers with the 'gym.manage_gym' permission and a null ('None') gym affiliation to perform unauthorized administrative actions against other users who also possess a null gym affiliation. Specifically, an attacker can delete, deactivate, or activate arbitrary user accounts within the scope of the None-affiliation group.\nThe root cause is a failure to correctly handle 'None' values in authorization logic, leading to an edge-case exploitation where the check evaluates incorrectly. This bypass grants unauthorized administrative control over account states, potentially leading to widespread account lockout or permanent data loss. The vulnerability affects all versions of wger through the master branch. The risk is significant as it provides privilege escalation within the context of global gym-management permissions.",
  "technicalDetails": "The vulnerability resides within the user management views in 'wger/core/views/user.py'. The application logic incorrectly relies on raw integer comparisons for verifying if a requesting user has the authority to perform administrative operations (delete, deactivate, activate) on a target user based on their associated 'gym' identifier.\nThe primary failure occurs when comparing the 'gym' attribute of both the requester and the target user. Where the code should invoke the 'is_same_gym()' helper function to enforce proper scoping and handle object relationships, it instead performs a direct comparison. Specifically, when both the attacker's gym attribute and the target user's gym attribute are 'None', the logic fails to restrict access correctly. In Python, the expression 'None != None' evaluates to false, which, in the context of the flawed conditional check, leads the application to incorrectly authorize the action.\nThe attack flow requires the attacker to hold the 'gym.manage_gym' permission. By having a null gym affiliation ('gym=None'), the attacker acts as a privileged user who, due to the logic error, is perceived by the application as having the authority to manage other users who are also not associated with a specific gym. Because the raw integer comparison logic does not safely handle the 'None' type, it fails to differentiate between an authorized administrator and a user who should be restricted to their own scope.\nExploitation involves the attacker sending specifically crafted HTTP requests to the affected views. By targeting the 'delete', 'deactivate', or 'activate' endpoints, an attacker can manipulate the user state for any target account also marked with 'gym=None'. This allows for a total compromise of such user accounts, including permanent account deletion, which is irreversible, or account lockout via deactivation. Furthermore, the ability to activate an account allows an attacker to undo administrative or defensive deactivations, potentially restoring access to malicious or compromised accounts. This vulnerability effectively turns 'gym.manage_gym' permission into a broader administrative bypass for all 'None' scoped users within the system."
}