https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 09:07:14 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-46434 <p>wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding any one of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.</p> <p>wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding any one of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-46434 https://vulnerability.circl.lu/vuln/ghsa-x249-cx55-2h87 <p><strong>Affected:</strong> PyPI: wger</p> <p>### Summary</p> <p>A user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding **any one** of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one.</p> <p>### Details</p> <p>`UserDeactivateView` (file: `wger/core/views/user.py`, line 378) is configured with:</p> <p>```python permission_required = (&#39;gym.manage_gym&#39;, &#39;gym.manage_gyms&#39;, &#39;gym.gym_trainer&#39;) ```</p> <p>`WgerMultiplePermissionRequiredMixin` (file: `wger/utils/generic_views.py`, line 48) treats this tuple as an OR check -- any single permission is sufficient:</p> <p>```python class WgerMultiplePermissionRequiredMixin(PermissionRequiredMixin): def has_permission(self): for permission in self.get_permission_required(): if self.request.user.has_perm(permission): return True # &lt;-- ANY one permission is enough return False ```</p> <p>The `dispatch()` method only verifies same-gym membership:</p> <p>```python def dispatch(self, request, *args, **kwargs): edit_user = get_object_or_404(User, pk=self.kwargs[&#39;pk&#39;]) if ( request.user.has_perm(&#39;gym.manage_gym&#39;) or request.user.has_perm(&#39;gym.gym_trainer&#39;) ) and edit_user.userprofile.gym_id != request.user.userprofile.gym_id:…</p> <p><strong>Affected:</strong> PyPI: wger</p> <p>### Summary</p> <p>A user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding **any one** of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one.</p> <p>### Details</p> <p>`UserDeactivateView` (file: `wger/core/views/user.py`, line 378) is configured with:</p> <p>```python permission_required = (&#39;gym.manage_gym&#39;, &#39;gym.manage_gyms&#39;, &#39;gym.gym_trainer&#39;) ```</p> <p>`WgerMultiplePermissionRequiredMixin` (file: `wger/utils/generic_views.py`, line 48) treats this tuple as an OR check -- any single permission is sufficient:</p> <p>```python class WgerMultiplePermissionRequiredMixin(PermissionRequiredMixin): def has_permission(self): for permission in self.get_permission_required(): if self.request.user.has_perm(permission): return True # &lt;-- ANY one permission is enough return False ```</p> <p>The `dispatch()` method only verifies same-gym membership:</p> <p>```python def dispatch(self, request, *args, **kwargs): edit_user = get_object_or_404(User, pk=self.kwargs[&#39;pk&#39;]) if ( request.user.has_perm(&#39;gym.manage_gym&#39;) or request.user.has_perm(&#39;gym.gym_trainer&#39;) ) and edit_user.userprofile.gym_id != request.user.userprofile.gym_id:…</p> https://vulnerability.circl.lu/vuln/ghsa-x249-cx55-2h87