The vulnerability in wger before version 2.6 involves an incorrect authorization check in the reset_user_password and gym_permissions_user_edit views. The check uses Python object comparison (!=) which evaluates None != None as False, bypassing authorization when both users have no gym assigned. This flaw allows a user with gym.manage_gym permission and no gym assignment to reset passwords of other users also without gym assignments. The new password is returned in plaintext in the HTML response, enabling immediate account takeover and permanent lockout of the victim. The vulnerability is addressed in wger 2.6.

An attacker with gym.manage_gym permission and no gym assignment can reset any other gym=None user's password and obtain the new password in plaintext, leading to full account takeover. The victim's original password is invalidated, causing permanent lockout. The vulnerability has a CVSS score of 9.9 (critical), indicating high impact on confidentiality, integrity, and availability.

This vulnerability is fixed in wger version 2.6. Users should upgrade to version 2.6 or later to remediate this issue. No official patch or temporary fix is indicated other than upgrading. Since this is not a cloud service, remediation depends on user action to update the software.