CVE-2026-46434: wger Trainer Privilege Escalation Due to Improper Privilege Management
Summary
CVE-2026-46434: wger: Trainer Privilege Escalation - Improper Privilege Management. Affects wger versions < 2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
wger is an open-source workout manager that allows users to manage gym activities, including user roles such as gym trainers and managers. The application is designed to facilitate gym operations by providing a platform for managing workouts, users, and gym-related activities. However, it has a critical vulnerability that allows users with lower privileges to deactivate accounts of users with higher privileges, undermining the security and management structure of the gym.
Vulnerability Detail
The vulnerability arises from the improper management of user permissions within the wger application. Specifically, a user with the 'gym_trainer' role can deactivate any account within the same gym, including those of 'gym_manager' and 'general_gym_manager'. This is due to the use of OR logic in permission checks, which does not enforce a hierarchy of privileges. The affected views, UserDeactivateView and UserActivateView, lack checks to prevent lower-privileged users from affecting higher-privileged accounts. This flaw can lead to significant security risks, including unauthorized account deactivation and potential denial of service for gym managers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict the creation of trainer accounts by gym managers or implement additional checks in the user management interface to prevent trainers from deactivating manager accounts until a proper fix is applied.
Conclusion
The wger application has a critical vulnerability that allows lower-privileged users to deactivate higher-privileged accounts, posing significant risks to gym management. It is essential to apply the recommended fixes and monitor for any potential exploitation of this vulnerability.
See every vulnerability recorded for wger →
FAQ
CVE-2026-46434 is a vulnerability in the wger application that allows users with the 'gym_trainer' role to deactivate accounts of users with higher privileges, such as 'gym_manager'.
This vulnerability can lead to unauthorized account deactivation, causing gym managers to lose access to their accounts and potentially disrupting gym operations.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Update the wger package to the latest version that includes a fix for this vulnerability, and implement the recommended privilege checks in the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for wger.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
