CVE-2026-86254 in wger
Summary
by MITRE • 09/06/2026
wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user with gym=None. Attackers with gym.manage_gym permission and gym=None affiliation can permanently delete user accounts, lock users out via deactivation, or undo defensive deactivations by exploiting the None != None comparison edge case.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/06/2026
The vulnerability identified in wger versions through master represents a critical authorization bypass rooted in improper handling of null values within Python's object identity and equality semantics. Specifically, the flaw resides in three distinct views located in the wger/core/views/user.py module which are responsible for managing user account states such as deletion, deactivation, and activation. These endpoints were intended to enforce scope-based access control by ensuring that only staff members belonging to a specific gym could perform actions on users within that same gym. However, due to an incomplete implementation of this security check, the code relies on raw integer or object comparison rather than utilizing the dedicated is_same_gym() helper function designed for robust identity verification. This architectural oversight creates a significant gap in access control logic that can be exploited by authenticated attackers possessing the manage_gym permission but lacking affiliation with any specific gym entity.
The technical core of this vulnerability lies in how Python handles comparisons involving None values. In many programming contexts, developers assume that comparing two null or empty references will yield an equality result indicating they are equivalent. However, depending on the implementation details and whether identity checks versus value checks are used, there is a risk where the condition intended to restrict access fails when both the attacker's gym attribute and the target user's gym attribute are None. If the code uses raw comparison operators that do not explicitly account for null equality in the manner required by the business logic, or if it relies on an identity check that behaves unexpectedly with singleton None objects across different scopes, the authorization gate is effectively bypassed. Consequently, a staff member who has no assigned gym can interact with other users who also have no assigned gym, treating them as being within the same scope despite having no legitimate administrative relationship.
The operational impact of this vulnerability is severe and directly affects the integrity and availability of user accounts within the system. An attacker exploiting this flaw can permanently delete any user account that has a null gym affiliation, leading to irreversible data loss for those users. Furthermore, the ability to deactivate or activate these accounts allows an adversary to lock legitimate users out of their systems indefinitely or restore access to previously deactivated malicious accounts. This capability undermines the fundamental principle of least privilege and compromises the administrative boundaries intended by the application's role-based access control model. The lack of proper scoping means that a single compromised account with manage_gym permissions but no gym assignment can exert disproportionate influence over other unaffiliated users, potentially facilitating further lateral movement or persistent denial-of-service conditions against specific user groups.
From a standards perspective, this vulnerability aligns closely with CWE-284 Improper Access Control and CWE-613 Insufficient Session Expiration if the session management compounds the issue, but primarily it is an authorization flaw where access control decisions are not enforced correctly. In terms of the MITRE ATT&CK framework, this behavior maps to T1078 Valid Accounts, as the attacker uses legitimate credentials with elevated permissions, and specifically relates to privilege escalation or abuse of existing functionality within a specific scope. The exploitation technique involves manipulating the context in which authorization checks are evaluated, leveraging edge cases in null handling to bypass security controls that were presumed to be robust.
Mitigation strategies must focus on correcting the underlying logic error in the user management views. Developers should replace all raw comparisons involving gym attributes with calls to the is_same_gym() helper function, ensuring consistent and secure evaluation of scope membership regardless of whether the values are None or specific identifiers. Additionally, input validation and explicit null checks should be implemented at the view level to reject requests where either party lacks a valid gym affiliation if such cross-gym operations are not intended by design. It is also advisable to conduct a comprehensive audit of other views in the application that perform similar scope-based authorization checks to ensure no analogous patterns exist elsewhere in the codebase. Regular security testing, including automated static analysis and dynamic penetration testing focused on access control bypasses, will help identify such logical flaws before they can be exploited in production environments.