CVE-2026-86254

Name of the Vulnerable Software and Affected Versions wger versions through master

Description An incomplete authorization bypass exists in the wger/core/views/user.py file. Three views utilize raw integer comparison for gym-scope checks instead of the is same gym() helper function. This allows gym staff members who have gym=None affiliation and the gym.manage gym permission to delete, deactivate, or activate any other user who also has gym=None. This occurs due to a logic error in the None != None comparison edge case.

Recommendations Update wger to a version where the is same gym() helper is correctly implemented in wger/core/views/user.py to replace raw integer comparisons.