CVE-2026-46434 · GHSA-x249-cx55-2h87
wger: Trainer Privilege Escalation - Improper Privilege Management
- Risk score
- 55/100
- CVSS
- 7.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gym_trainer permission can deactivate any account in the same gym, including gym_manager and general_gym_manager accounts. The UserDeactivateView grants access to anyone holding any one of gym.manage_gym, gym.manage_gym…
- Affected
- wger (pip) <= 2.1
- Fix
- No patched version listed yet: check the advisory for mitigations.
- Exploitation
- Public proof of concept
Why it is Yellow
- CVSS 7.1 high
- Public exploit or proof of concept referenced
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| wger | pip | <= 2.1 | No fix yet |
References
Original description
wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding any one of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.
Last activity 7 Oct 2026. Patch Forecast updates every hour.