CyberRota Analysis
AI-GeneratedAn incomplete authorization bypass in wger allows gym staff with the gym.manage_gym permission and a gym affiliation of None to manipulate user accounts, including deletion and deactivation, due to improper integer comparison in user permission checks. This vulnerability can lead to unauthorized account management, potentially impacting user access and data integrity. Organizations using affected versions of wger should prioritize patching to mitigate risks associated with unauthorized user account manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user with gym=None. Attackers with gym.manage_gym permission and gym=None affiliation can permanently delete user accounts, lock users out via deactivation, or undo defensive deactivations by exploiting the None != None comparison edge case.