Vulnerability · Published Sep 6, 2026 · Assigned by VulnCheck

CVE-2026-86254wger Incomplete Authorization Fix Cross-Tenant Account Deletion

Medium 6.8

In plain English

A medium-severity missing authorization in wger from wger-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 68.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user with gym=None. Attackers with gym.manage_gym permission and gym=None affiliation can permanently delete user accounts, lock users out via deactivation, or undo defensive deactivations by exploiting the None != None comparison edge case.

Affected products (as reported)

Vendor	Product	Versions
wger-project	wger	0 – through master

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

References

GitHub Security Advisory (GHSA-mw8f-w6p8-xrf4) vendor-advisory
VulnCheck Advisory: wger Incomplete Authorization Fix Cross-Tenant Account Deletion third-party-advisory