EUVD-2026-72110
GHSA-qc8h-h7c3-v2gh
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because both attacker and victim must have gym=None; PR:L for the required gym.manage_gym permission; no confidentiality impact from these three write-side views.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user with gym=None. Attackers with gym.manage_gym permission and gym=None affiliation can permanently delete user accounts, lock users out via deactivation, or undo defensive deactivations by exploiting the None != None comparison edge case.
AnalysisAI
Incomplete authorization fix in wger through master exposes three user-management views in wger/core/views/user.py to the same None != None gym-scope bypass previously identified in CVE-2026-43948 (GHSA-mhc8-p3jx-84mm). A gym staff member holding gym.manage_gym permission whose account has gym=None - the default unlinked state for any newly provisioned staff account - can permanently delete, deactivate, or re-activate any other user also carrying gym=None, exploiting a raw integer comparison that evaluates None != None as False instead of blocking the operation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the attacker must hold a wger account with the gym.manage_gym permission AND have gym=None (unlinked from any specific gym - this is the default state for any newly provisioned staff account before an administrator assigns them to a gym); and (2) each victim account must also have gym=None. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/VI:H/VA:H) accurately captures that exploitation requires a specific precondition - both attacker and victim must have gym=None - which raises effective complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the advisory at https://github.com/wger-project/wger/security/advisories/GHSA-mw8f-w6p8-xrf4 lists the fixed version as None. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2. Rated cri
Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privi
Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to
Wger versions up to 2.4 allow authenticated users to access other users' private nutrition plans through insecure direct
Wger versions up to 2.4 expose all users' repetition configuration data to any authenticated attacker due to missing aut
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and
wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calli
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's
Open redirect in wger's trainer_login view allows an attacker to redirect an authenticated trainer's browser to an arbit
CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadshe
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today