In wger versions prior to 2.5, the GymConfigUpdateView class specifies a permission requirement ('config.change_gymconfig') but inherits from WgerFormMixin instead of WgerPermissionMixin, causing the permission check to be bypassed at runtime. Because GymConfig is an ownerless singleton, any authenticated user can modify the global gym configuration. This modification triggers side effects such as bulk-updating user profile gym assignments, effectively escalating privileges vertically to control the entire installation's configuration. The vulnerability is addressed in wger version 2.5.

An authenticated user without proper permissions can modify the global gym configuration, resulting in a vertical privilege escalation. This allows unauthorized changes affecting all users of the installation, potentially impacting data integrity and system behavior. The CVSS score of 7.6 (high) reflects the network attack vector, low attack complexity, required privileges, no user interaction, and significant impact on integrity and availability.

Upgrade to wger version 2.5 or later, where this vulnerability is fixed by proper enforcement of permission checks in GymConfigUpdateView. Since no official patch link or advisory is provided, users should verify the version and update accordingly. Patch status is not explicitly confirmed beyond the fix in version 2.5, so check the vendor's repository or release notes for confirmation.